Wireshark Packet Analysis: The SOC Analyst’s Secret Weapon for Detecting C2, Data Leaks, and Reconnaissance + Video

By /

Listen to this Post

Featured Image

Introduction:

Network packet analysis is the cornerstone of modern Security Operations Center (SOC) monitoring. By examining raw network traffic with tools like Wireshark, security professionals can detect anomalies that traditional security appliances often miss—from malware beaconing to command-and-control (C2) servers, to sensitive data traversing the network in cleartext. This article breaks down the essential packet analysis techniques every aspiring SOC analyst must master, moving beyond theoretical concepts to practical, hands-on skills that directly translate to threat hunting and incident response.

Learning Objectives:

  • Master Wireshark filters to isolate DNS, HTTP, and TCP traffic for rapid anomaly detection.
  • Understand the TCP three-way handshake and identify abnormal patterns indicative of port scanning or reconnaissance.
  • Analyze unencrypted HTTP traffic to spot data exposure risks and potential man-in-the-middle attacks.
  • Apply packet-level insights to correlate network activity with common web application vulnerabilities like SQL injection and XSS.

You Should Know:

1. DNS Resolution: Following the Domain-to-IP Pipeline

DNS is the phonebook of the internet—but it’s also a primary vector for data exfiltration and C2 communication. Before any connection can occur, a domain name must be resolved to an IP address. SOC analysts monitor DNS queries to detect unusual patterns: repeated requests to unknown domains, excessively long subdomains (a classic data exfiltration trick), or queries to newly registered malicious domains.

Step‑by‑step guide to DNS analysis with Wireshark:

  1. Start a live capture on your active network interface (e.g., Ethernet or Wi-Fi).
  2. Apply the DNS filter: In the Wireshark filter bar, type `dns` and press Enter. This isolates all DNS query and response packets.
  3. Identify a DNS query: Look for packets with `Standard query` in the Info column. Expand the `Domain Name System (query)` section in the packet details pane to see the requested domain.
  4. Find the corresponding response: Locate the `Standard query response` packet. Expand the `Answers` section to view the resolved IP address(es).
  5. Export DNS names for threat intelligence correlation: Go to `Statistics` → `DNS` → `DNS Statistics` to see a list of all queried domains.

Linux command for DNS reconnaissance (equivalent to what Wireshark captures):

 Perform a DNS lookup and capture the traffic with tcpdump for later analysis
tcpdump -i eth0 -1 port 53 -w dns_traffic.pcap
 Then open dns_traffic.pcap in Wireshark and apply filter: dns

Windows command (using nslookup and netsh for packet capture):

nslookup example.com
 To capture DNS traffic on Windows, use: netsh trace start capture=yes provider=Microsoft-Windows-DNS-Client tracefile=C:\dns.etl

2. HTTP Request/Response: Exposing Cleartext Dangers

Unencrypted HTTP traffic is a goldmine for attackers and a red flag for defenders. Following a full HTTP stream lets you see the exact GET request, headers, and the 200 OK response—including any sensitive data transmitted in plaintext. In a SOC environment, spotting HTTP traffic to internal servers or external sites without TLS is an immediate priority for investigation.

Step‑by‑step guide to HTTP stream analysis:

  1. Capture live traffic or open a saved `.pcap` file.
  2. Apply the HTTP filter: Type `http` in the filter bar.
  3. Select a packet that shows `GET` or `POST` in the Info column.
  4. Follow the HTTP stream: Right-click the packet → `Follow` → HTTP Stream. A new window will display the entire request and response in plaintext.
  5. Analyze the content: Look for exposed credentials, session tokens, or sensitive form data. Also inspect the `User-Agent` and `Referer` headers for anomalies.

Linux command to extract HTTP objects from a pcap:

 Extract all HTTP objects (images, scripts, etc.) from a pcap file
tshark -r capture.pcap --export-objects "http,./extracted_http"

Windows equivalent using Wireshark’s command-line tools:

"C:\Program Files\Wireshark\tshark.exe" -r capture.pcap --export-objects "http,C:\extracted"
  1. TCP 3-Way Handshake: The Foundation of Every Connection

Every reliable network connection begins with the SYN → SYN-ACK → ACK sequence. This handshake is not just academic—it’s how SOC analysts detect port scans, SYN floods, and other reconnaissance activities. An abnormal handshake pattern—such as a high volume of SYNs with no ACKs—often signals an attacker probing for open ports.

Step‑by‑step guide to handshake analysis:

  1. Apply the TCP filter: Type `tcp` in the Wireshark filter bar.
  2. Find the SYN packet: Look for a packet with ` 
    ` in the Info column and <code>Len=0</code>.</li>
<li>Locate the SYN-ACK: The responding packet will show <code>[SYN, ACK]</code>.</li>
<li>Identify the final ACK: The third packet will have `[bash]` and often contains the first payload data.</li>
<li>Detect scanning behavior: Use `Statistics` → `Conversations` → `TCP` to see the number of connections per source IP. A single IP with hundreds of SYN packets to different ports is a strong indicator of a port scan.</li>
</ol>

Linux command to detect SYN scans from a pcap:
[bash]
 Count SYN packets per source IP (no ACK flags)
tshark -r capture.pcap -Y "tcp.flags.syn==1 and tcp.flags.ack==0" -T fields -e ip.src | sort | uniq -c | sort -1r

    Windows PowerShell snippet for similar analysis:

     Using TShark on Windows to count SYN-only packets
& "C:\Program Files\Wireshark\tshark.exe" -r C:\capture.pcap -Y "tcp.flags.syn==1 and tcp.flags.ack==0" -T fields -e ip.src | Group-Object | Sort-Object Count -Descending

    4. Correlating Network Traffic with Web Vulnerabilities

    Packet analysis connects the dots between application-layer attacks (SQL injection, XSS, brute force) and the network layer where they are executed. A SQL injection attempt, for instance, will appear as an HTTP request with suspicious characters in the URL or POST data. Similarly, a brute-force attack will show a high volume of HTTP POST requests to a login endpoint from a single source IP.

    Step‑by‑step guide to vulnerability correlation:

    1. Filter HTTP requests that contain common attack patterns: `http.request.uri matches “(\%27)|(\’)|(\%22)|(\”)|(\%3B)|(;)”` to catch SQL injection attempts.
    2. Identify brute-force attempts: Apply `http.request.method == “POST” and http.request.uri contains “/login”` and then check the packet rate from each source IP.
    3. Look for XSS payloads: Filter for `http contains “