Listen to this Post
Introduction:
In the high-stakes world of Operational Technology (OT) and Industrial Control Systems (ICS) security, visibility is the first and most critical line of defense. While often pigeonholed as an IT troubleshooting tool, Wireshark is, in fact, a potent cyber weapon and shield. This article delves into the advanced application of Wireshark filters from an adversarial perspective, providing security professionals with the knowledge to detect reconnaissance, protocol manipulation, and suspicious activity within sensitive industrial networks before catastrophic breaches occur.
Learning Objectives:
- Understand and apply key Wireshark display filters for OT/ICS network discovery and threat detection.
- Analyze traffic for specific industrial protocols (Modbus, S7comm, DNP3) to identify malicious commands or anomalies.
- Build a practical methodology for proactive network evidence collection and forensic investigation in OT environments.
You Should Know:
1. Adversarial Network Discovery and Reconnaissance
The first phase of any attack is understanding the target landscape. Attackers use Wireshark to passively map networks, identify devices, and pinpoint critical controllers. This mirrors legitimate admin activity, making detection subtle.
Step-by-step guide explaining what this does and how to use it.
Objective: Capture and analyze broadcast, ARP, and DHCP traffic to build a network map.
Action: Deploy a network tap or use port mirroring (SPAN) on a switch to capture traffic to your analysis machine running Wireshark. Begin a capture.
Analysis: Apply the following filters to sift through the data:
Find broadcast traffic: eth.dst == ff:ff:ff:ff:ff:ff. This reveals devices announcing themselves or seeking others.
Identify ARP responses: arp.opcode == 2. This shows devices actively mapping IP addresses to MAC addresses, revealing live hosts.
Spot DHCP requests: bootp.option.type == 53. This uncovers new devices joining the network or existing ones renewing leases.
Complementary Command-Line Tool (Linux): Use `tcpdump` for initial capture and lightweight analysis: sudo tcpdump -i eth0 -w ot_capture.pcap 'port 67 or port 68 or arp'. This captures DHCP and ARP traffic specifically for later review in Wireshark.
2. Detecting Suspicious Scanning and Connection Attempts
Lateral movement and exploitation follow reconnaissance. Unusual connection patterns are a primary indicator of compromise in segmented OT networks where communication is highly predictable.
Step-by-step guide explaining what this does and how to use it.
Objective: Detect SYN scans, connections to unauthorized ports, and beaconing to command-and-control servers.
Action: Analyze a packet capture from a critical network segment, such as the control network layer.
Analysis: Use these filters to hunt for anomalies:
Port Scanning (SYN Scan): tcp.flags.syn == 1 && tcp.flags.ack == 0. A high volume of these packets from a single source indicates a scan.
Connections to Uncommon OT Ports: tcp.dstport < 1 || (tcp.dstport > 1024 && tcp.dstport != 502 && tcp.dstport != 44818). This filters for traffic to non-standard ports, which may be malware or unauthorized access.
General High-Port Traffic: tcp.dstport > 1024. Useful for a broad view of non-standard service traffic.
Windows PowerShell Tip: Use `Get-NetTCPConnection` on a suspected endpoint to cross-reference active connections with Wireshark findings: Get-NetTCPConnection -State Established | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort.
3. Mastering Core Utility Filters for Efficient Analysis
Efficient forensic analysis requires isolating specific conversations and hosts. These utility filters are the bedrock of navigating large packet captures.
Step-by-step guide explaining what this does and how to use it.
Objective: Quickly drill down into a specific TCP stream, isolate traffic to/from a single host, or examine all traffic on a specific port.
Action: Open a packet capture file (e.g., from the provided GitHub repos) and practice these essential filters.
Analysis & Application:
- Follow a TCP Stream: Right-click a TCP packet → “Follow” → “TCP Stream”. Wireshark applies a filter like
tcp.stream eq 7, reconstructing the entire application-layer conversation. This is crucial for understanding protocol commands. - Filter by IP: `ip.addr == 192.168.1.10` shows all traffic to and from this host.
- Filter by MAC: `eth.addr == 00:1a:2b:3c:4d:5e` tracks a device regardless of its IP address.
- Conversations by Port: `tcp.port == 102` shows all traffic on port 102 (Siemens S7comm).
4. Deep Dive into Modbus Protocol Analysis
Modbus, a ubiquitous industrial protocol, is often a primary target due to its lack of native authentication. Attackers can inject commands to manipulate physical processes.
Step-by-step guide explaining what this does and how to use it.
Objective: Identify, isolate, and interpret Modbus traffic to detect unauthorized read/write commands.
Action: Capture or analyze traffic on a network segment containing PLCs and HMIs.
Analysis: Apply these protocol-specific filters:
modbus: Displays all Modbus (TCP and RTU over TCP) traffic.
tcp.port == 502: The standard Modbus TCP port.
modbus.func_code == 5: Filters for “Write Single Coil” commands. An attacker might use this to forcibly turn a valve or breaker on/off.
Interpretation: In a “Write Single Coil” packet, examine the `Modbus Data` section. The `Reference Number` is the coil address, and the `Data` field (ff 00 = ON, `00 00` = OFF) shows the commanded state.
5. Analyzing Other Critical OT/ICS Protocols
A mature OT security program requires familiarity with a suite of proprietary protocols. Each has unique functions and vulnerabilities.
Step-by-step guide explaining what this does and how to use it.
Objective: Identify and filter for key proprietary protocols to baseline normal traffic and spot deviations.
Action: Use Wireshark’s powerful protocol dissectors by applying these filters to a diverse OT capture.
Analysis & Protocol Primer:
Siemens S7comm: `tcp.port == 102` or s7comm. Used for programming and data exchange with Siemens PLCs. Look for unauthorized `Start Upload` or `Download` commands.
DNP3 (Distributed Network Protocol): `tcp.port == 20000` or dnp3. Common in electric power. Filter for `dnp3.al.function_code` to see commands like `SELECT` and OPERATE.
EtherNet/IP (CIP): `tcp.port == 44818` or cip. Common in manufacturing. Attackers can use explicit messaging to read/write tags.
Profinet: eth.type == 0x8892. A real-time industrial Ethernet protocol. Use `pndt` for Profinet Discovery and basic configuration.
BACnet/IP: `udp.port == 47808` or bacnet. Used in building automation. Monitor for unauthorized `WriteProperty` requests.
Where to Find Practice Packet Captures (PCAPs):
GitHub Repository – ICS-Security-Tools: Contains various resources, including PCAP files for analysis practice. (Link: https://github.com/ITI/ICS-Security-Tools`)https://github.com/automayt/ICS-pcap`)
GitHub Repository - ICS-pcap: A dedicated collection of packet captures from industrial systems. (Link:
What Undercode Say:
Key Takeaway 1: Wireshark transcends troubleshooting; it is a fundamental tool for offensive reconnaissance and defensive forensics in OT environments. The filters provided are the literal search queries of an attacker’s mind.
Key Takeaway 2: Security in OT is not about preventing all traffic but about knowing exactly what legitimate traffic looks like. Any deviation—a new IP on port 502, a write command to a critical coil, traffic on an unexpected port—must be treated as a potential incident until proven otherwise.
The analysis underscores a paradigm shift: the tools of the network administrator have become the weapons of the adversary. Holcomb’s post correctly frames Wireshark not as a niche utility but as a central platform for cyber threat intelligence in the physical domain. The provided filters are actionable intelligence—a detection rulebook derived from adversarial tradecraft. For defenders, mastering these filters is equivalent to learning the language of the attacker, allowing them to hear the whispers of reconnaissance and the footsteps of intrusion long before the industrial process is disrupted. The convergence of IT and OT security mandates that this skillset moves from “specialist” to “standard” for anyone responsible for critical infrastructure.
Prediction:
As IT/OT convergence accelerates and legacy protocols persist, packet-level analysis will become even more critical for intrusion detection and forensic attribution. We predict a rise in AI-assisted Wireshark plugins that automatically baseline normal OT protocol behavior and flag anomalies in real-time, moving from passive analysis to active, intelligent threat hunting. Furthermore, as attackers increasingly tailor malware (e.g., Industroyer2, PIPEDREAM) to specific OT protocols, defenders’ ability to manually dissect and understand these communications will be the last line of defense against sophisticated, targeted attacks that bypass perimeter security. The future of OT security is deep packet inspection.
▶️ Related Video (72% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Mikeholcomb Think – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
