Wireshark: The OT/ICS Attacker’s Best Friend – Here’s How to Beat Them at Their Own Game + Video

By /

Listen to this Post

Featured Image

Introduction:

Wireshark is often dismissed as a simple IT network troubleshooting tool, but in the wrong hands – and the right ones – it is one of the most powerful cybersecurity weapons ever created. Attackers routinely use Wireshark to map industrial control system (ICS) networks, discover vulnerable devices, and silently exfiltrate operational data, making it just as dangerous as any exploit framework. For defenders, mastering Wireshark with an OT/ICS-specific lens is no longer optional; it is the foundational skill needed to detect reconnaissance, identify anomalies, and secure critical infrastructure before a breach occurs.

Learning Objectives:

  • Master OT/ICS-specific Wireshark display filters to rapidly identify rogue devices, scanning activity, and unauthorized protocol usage across industrial networks.
  • Learn to differentiate between legitimate operational traffic and malicious reconnaissance by analyzing Modbus, DNP3, S7, and Ethernet/IP communications.
  • Acquire hands-on skills to capture, analyze, and replay ICS packet captures (PCAPs) for threat hunting, incident response, and security testing.

You Should Know:

  1. Network Discovery – Seeing Your ICS Environment as an Attacker Does

Before an adversary can launch an attack, they must first understand the network layout, identify live hosts, and map IP-to-MAC relationships. Wireshark makes this passive reconnaissance terrifyingly simple.

Step-by-Step Guide:

  1. Capture Broadcast Traffic: Start a Wireshark capture on the OT network interface and apply the filter eth.dst == ff:ff:ff:ff:ff:ff. This reveals all broadcast packets, often exposing DHCP requests, ARP probes, and NetBIOS name queries that disclose hostnames and IP configurations.
  2. Map IP-to-MAC Addresses: Apply `arp.opcode == 2` to isolate ARP reply packets. These responses map an IP address to a physical MAC address, providing a real-time inventory of active devices on the network segment.
  3. Identify Dynamic Host Configuration: Use `bootp.option.type == 53` to view DHCP Discover and Request messages. This filter reveals which devices are requesting IP leases and the addresses being assigned, offering insight into the network’s addressing scheme and potential rogue DHCP servers.
  4. Correlate with Nmap Scanning: To validate findings, run an Nmap scan from a Linux host using `sudo nmap -sn 192.168.1.0/24` and compare the discovered IPs with those observed in Wireshark. Any discrepancies may indicate devices that are not responding to pings but are actively communicating.
  5. Windows Command-Line Alternative: On Windows, use `arp -a` from an elevated command prompt to view the local ARP cache, then cross-reference with the MAC addresses observed in your Wireshark capture to confirm device identities.

  6. Suspicious Activity – Detecting Scanning and Unauthorized Connections

Attackers rarely go straight for the kill; they probe, scan, and test for open ports and vulnerable services. Wireshark can expose these telltale signs of pre-attack reconnaissance.

Step-by-Step Guide:

  1. Detect SYN Scans: Apply the filter tcp.flags.syn == 1 && tcp.flags.ack == 0. This isolates TCP SYN packets without the ACK flag, which are the hallmark of a port scan. A sudden flood of such packets from a single source IP to multiple destination ports indicates an active scan.
  2. Identify Connections to Uncommon Ports: Use the complex filter tcp.dstport < 1 || (tcp.dstport > 1024 && tcp.dstport != 502 && tcp.dstport != 44818). This effectively flags any TCP traffic destined for ports below 1 or above 1024, excluding the standard Modbus (502) and Ethernet/IP (44818) ports. This is a powerful indicator of an attacker probing for non-standard services or backdoors.
  3. Spot High-Port Outbound Connections: Apply `tcp.dstport > 1024` to view all connections to ports above 1024. While some legitimate OT traffic uses high ports, a sustained stream of outbound connections from a controller to an unknown external IP on a high port is a strong red flag for command-and-control (C2) activity.
  4. Analyze with Zeek (formerly Bro): For deeper analysis, use Zeek to generate logs from the PCAP. Run `zeek -r capture.pcap` and examine the `conn.log` file. Look for connections with high `orig_pkts` and `resp_pkts` counts but zero bytes, which often indicate scanning.
  5. Windows PowerShell Detection: On a Windows host, you can use `Get-1etTCPConnection -State Established` to view active connections. Combine this with Wireshark by identifying the remote IPs and ports seen in the capture, then checking for any that are not part of your known asset inventory.

3. Protocol Analysis – Diving into Modbus Communications

Modbus is the lingua franca of industrial control, and understanding its traffic is critical for any OT security analyst. The ability to filter and interpret Modbus commands can reveal unauthorized writes or device manipulation.

Step-by-Step Guide:

  1. Isolate All Modbus Traffic: Apply the simple filter `modbus` to display only packets containing Modbus protocol data. For a more targeted view, use `tcp.port == 502` to filter by the default Modbus TCP port.
  2. Detect Write Operations: Apply the filter `modbus.func_code == 5` to isolate Modbus “Write Single Coil” commands. This is a critical filter for security monitoring, as an attacker attempting to manipulate a physical process (e.g., opening a valve or starting a motor) will often use this function code.
  3. Follow the Modbus Stream: Right-click on any Modbus packet and select “Follow” -> “TCP Stream” to reconstruct the entire conversation. Use `tcp.stream eq ` to isolate that specific stream in the display. This allows you to see the sequence of requests and responses, which is invaluable for understanding the logic of a control sequence.
  4. Analyze Modbus Function Codes: Expand the Modbus protocol tree in the packet details pane. Look for function codes like 1 (Read Coils), 2 (Read Discrete Inputs), 3 (Read Holding Registers), and 4 (Read Input Registers). A high volume of read requests from an unfamiliar IP could indicate data exfiltration.
  5. Linux Command-Line Analysis: Use `tshark` (the command-line version of Wireshark) to filter Modbus traffic directly from the terminal: tshark -r capture.pcap -Y "modbus.func_code == 5". This is ideal for automated scripting and remote analysis.

  6. Exploring Other OT/ICS Protocols – S7, DNP3, Ethernet/IP, and More

Modern ICS environments are a tapestry of protocols. A defender must be fluent in the filters for each to spot anomalies.

Step-by-Step Guide:

  1. Siemens S7 Communications: Use `tcp.port == 102` to filter S7 traffic. For a more protocol-specific view, use s7comm. This is essential for monitoring Siemens PLC environments.
  2. DNP3 (Distributed Network Protocol): Filter DNP3 traffic with `tcp.port == 20000` or simply dnp3. DNP3 is widely used in the electric power industry, and these filters help isolate SCADA communications from other network noise.
  3. Ethernet/IP (Common Industrial Protocol): Use `tcp.port == 44818` or `etherip` to filter Ethernet/IP traffic, which is prevalent in Rockwell Automation environments.
  4. Profinet: Apply `eth.type == 0x8892` to filter Profinet traffic directly by Ethernet type. This is a fast way to isolate real-time industrial Ethernet traffic.
  5. BACnet (Building Automation): Use `udp.port == 47808` or `bacnet` to filter BACnet traffic, which is common in HVAC and building management systems.
  6. Leverage the ICS-pcap Repository: To practice these filters, clone the `ICS-pcap` repository from GitHub. Use `git lfs clone https://github.com/automayt/ICS-pcap.git` after installing Git LFS. This repository contains a wealth of PCAPs for various protocols, including BACNET, CODESYS, and DNP3, providing a realistic sandbox for honing your analysis skills.

  7. Advanced Threat Hunting – Combining Filters for Deep Investigation

Single filters are useful, but the real power of Wireshark lies in combining them to uncover sophisticated attack patterns.

Step-by-Step Guide:

  1. Find Modbus Writes from Non-Standard Sources: Combine filters to find Modbus write commands originating from an IP that is not part of your known asset list. Use `modbus.func_code == 5 && ip.src != 192.168.1.100` (replace with your trusted IP).
  2. Detect ARP Spoofing: Use the filter `arp.duplicate-address-frame` to detect ARP spoofing attempts, where an attacker tries to redirect traffic by claiming another device’s IP.
  3. Identify Cleartext Credentials: Many OT protocols transmit credentials in cleartext. Use the filter `tcp contains “password”` or `modbus contains “password”` to search for plaintext passwords in the packet payload.
  4. Use the ICS-Security-Tools Repository: The `ITI/ICS-Security-Tools` repository is a treasure trove of scripts, configurations, and guides. Explore the `/pcaps` and `/scripts` directories for additional resources and automation scripts that can be integrated into your threat-hunting workflow.
  5. Automate with TShark: Create a simple bash script to run these filters against a directory of PCAPs: 
    !/bin/bash
for pcap in .pcap; do
echo "Analyzing $pcap for Modbus writes..."
tshark -r "$pcap" -Y "modbus.func_code == 5" -T fields -e ip.src -e ip.dst -e modbus.func_code
done

    This script provides a rapid, high-level overview of all write operations across multiple captures.

What Undercode Say:

  • Key Takeaway 1: Wireshark is not merely a diagnostic tool; it is a dual-use cyber weapon that attackers actively employ for OT reconnaissance, and defenders must adopt the same mindset to effectively monitor and protect industrial networks.
  • Key Takeaway 2: Mastering a curated set of OT/ICS-specific display filters – from basic ARP and DHCP discovery to deep-dive Modbus and DNP3 analysis – transforms Wireshark from a general-purpose sniffer into a specialized threat-hunting platform for critical infrastructure.

Analysis: The post by Mike Holcomb brilliantly demystifies the application of Wireshark in OT/ICS security by providing immediately actionable filters. It correctly shifts the perspective from passive troubleshooting to active threat detection, emphasizing that attackers are already using these very techniques. The inclusion of free packet capture repositories is a masterstroke, as it lowers the barrier to entry for practitioners to gain hands-on experience in a safe, controlled environment. Furthermore, the post implicitly underscores a critical gap in many security programs: the lack of continuous, deep packet inspection in OT environments. By highlighting specific function codes like Modbus “write single coil”, it moves beyond generic alerting to precise, actionable indicators of compromise. The actionable nature of the content, combined with the call to action to follow and subscribe, makes this an invaluable resource for the community, bridging the gap between theoretical knowledge and practical, defensive application.

Prediction:

  • +1 The widespread adoption of these Wireshark techniques will democratize OT security, enabling smaller industrial operators to build robust monitoring capabilities without expensive, proprietary solutions.
  • +1 Community-driven PCAP repositories will become the de facto standard for training and validating intrusion detection systems, fostering a collaborative defense ecosystem against ICS-specific threats.
  • -1 As defenders become more proficient with these filters, attackers will increasingly turn to encrypted tunnels and application-layer obfuscation to hide their reconnaissance, shifting the cat-and-mouse game to deeper protocol analysis and behavioral baselining.
  • +1 The integration of these Wireshark filters into Security Information and Event Management (SIEM) and Network Detection and Response (NDR) platforms will automate threat detection, drastically reducing mean time to detect (MTTD) for OT intrusions.
  • -1 The sheer volume of alerts generated by improperly tuned filters could lead to alert fatigue, potentially causing analysts to overlook subtle, low-and-slow attacks that evade basic pattern matching.
  • +1 The increasing accessibility of free educational content, like the videos and newsletter mentioned in the post, will accelerate the development of a new generation of OT security professionals who are as comfortable with packet analysis as they are with PLC programming.

▶️ Related Video (76% Match):

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Mikeholcomb Think – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: