Network Forensics: PCAP Analysis for SOC Investigations

Prerequisites

• FND-K003: Networking Fundamentals for Security Practitioners
• COA-K001: SOC Architecture & Alert Lifecycle

Why This Lesson Matters

Alerts fire. Sometimes all you have to validate them is a PCAP snippet captured by an IDS or an NDR appliance. The ability to open that PCAP, find the relevant traffic quickly, and extract actionable evidence is a daily L2 skill and a critical L1 escalation skill.

1. PCAP Triage Workflow

When you receive a PCAP for investigation, follow this five-step triage:

Step 1: Orientation — what is in this PCAP?
  tshark -r file.pcap -q -z io,phs       # protocol hierarchy
  tshark -r file.pcap -q -z endpoints,ip # list all IPs

Step 2: Isolate the interesting traffic
  tshark -r file.pcap -Y "http || ftp || smtp || telnet"

Step 3: Follow interesting streams
  Right-click in Wireshark → Follow → TCP/UDP Stream
  OR: tshark -r file.pcap -q -z follow,tcp,ascii,<stream_id>

Step 4: Extract artefacts
  Credentials, file transfers, commands, payloads

Step 5: Document findings
  IP pair, protocol, what was found, evidence frame numbers

2. Credential Extraction Protocols

2.1 HTTP Basic Authentication

# Find HTTP Basic Auth in a PCAP
tshark -r capture.pcap -Y "http.authorization" 
  -T fields -e frame.number -e ip.src -e ip.dst -e http.authorization

# Output example:
# 47  10.0.0.5  203.0.113.10  Basic dXNlcjpzM2NyZXQ=

# Decode the credential
echo "dXNlcjpzM2NyZXQ=" | base64 -d
# user:s3cret

2.2 FTP Credentials

FTP sends credentials in cleartext in the PASS and USER commands:

# Extract FTP credentials
tshark -r capture.pcap -Y "ftp.request.command == USER || ftp.request.command == PASS" 
  -T fields -e frame.number -e ftp.request.command -e ftp.request.arg

# Or follow the FTP control stream
tshark -r capture.pcap -Y "ftp" -T fields -e tcp.stream | sort -u
# Then follow stream 0: tshark -r capture.pcap -q -z follow,tcp,ascii,0

2.3 SMTP Session

# Show SMTP commands
tshark -r capture.pcap -Y "smtp" 
  -T fields -e frame.time -e smtp.req.command -e smtp.req.parameter

# Follow an SMTP stream to see full email content
tshark -r capture.pcap -Y "smtp" -T fields -e tcp.stream | sort -u | head -3
tshark -r capture.pcap -q -z follow,tcp,ascii,<stream_id>

Key SMTP commands and their evidence value:

2.4 Telnet

Telnet sends every keystroke as a separate TCP packet. Reassembling the stream reveals commands typed:

# Follow Telnet stream
tshark -r capture.pcap -Y "telnet" -T fields -e tcp.stream | sort -u
tshark -r capture.pcap -q -z follow,tcp,ascii,<stream_id>

# Telnet keystroke reconstruction (each packet may be 1 character)
# Look for response echoes — the server echoes each character back

3. File Extraction from PCAP

3.1 HTTP File Downloads

# Export all HTTP objects (Wireshark GUI)
File → Export Objects → HTTP → Save All

# Using tshark
tshark -r capture.pcap --export-objects http,/tmp/http_objects/

# Manual: find the file transfer stream and extract with tshark
tshark -r capture.pcap -Y "http.response.code == 200" 
  -T fields -e tcp.stream -e http.content_type | sort -u
# Then export specific stream:
tshark -r capture.pcap -q -z follow,tcp,raw,<stream_id> | 
  tail -n +7 | xxd -r -p > extracted_file.bin

3.2 FTP Data Transfer

FTP uses a separate data connection (port 20 or passive mode random port). The control stream shows RETR/STOR commands; the data stream carries the file content.

# Identify FTP data transfer command
tshark -r capture.pcap -Y "ftp.request.command == RETR" 
  -T fields -e ftp.request.arg -e frame.time

# Export FTP data objects
tshark -r capture.pcap --export-objects ftp-data,/tmp/ftp_objects/

4. C2 Detection in PCAPs

4.1 Identifying C2 Traffic

Signs of C2 in a PCAP:

# Find all unique destination IPs and ports
tshark -r capture.pcap -T fields -e ip.dst -e tcp.dstport | sort | uniq -c | sort -rn

# Find connections to uncommon ports on external IPs
tshark -r capture.pcap -Y "not ip.dst == 10.0.0.0/8 and not ip.dst == 192.168.0.0/16" 
  -T fields -e ip.src -e ip.dst -e tcp.dstport | sort | uniq -c | sort -rn

# Find HTTP requests with suspicious User-Agents
tshark -r capture.pcap -Y "http.user_agent" 
  -T fields -e ip.src -e http.host -e http.user_agent | sort -u

4.2 DNS Exfiltration Quick Check

# Find all DNS query names and their lengths
tshark -r capture.pcap -Y "dns.flags.response==0" 
  -T fields -e dns.qry.name 
  | awk '{print length($0), $0}' | sort -rn | head -20

# Labels > 30 chars = suspicious
# Many queries to one domain = possible exfil
tshark -r capture.pcap -Y "dns.flags.response==0" 
  -T fields -e dns.qry.name 
  | awk -F'.' '{d=$(NF-1)"."$NF; count[d]++} END{for(d in count) print count[d],d}' 
  | sort -rn | head -10

5. Writing a PCAP Investigation Note

A complete PCAP investigation note for escalation or closure:

Investigation Note — COA-2026-0608-001
Analyst: [Name] | Date: 2026-06-08 14:45 UTC

Alert: IDS rule fired — "FTP cleartext credential detected"
PCAP: incident_capture.pcap (SHA256: a3f9b2...)

Findings:
1. FTP session: 10.0.0.15 → 203.0.113.5:21
   - Frame 12: USER admin
   - Frame 14: PASS s3cr3tp4ss
   - Credentials transmitted in cleartext

2. Subsequent file transfer (FTP-DATA):
   - RETR: /etc/passwd (frame 28)
   - File extracted: passwd_dump.txt (see attachment)

3. No encrypted session observed — FTP, not SFTP

CIA Impact: Confidentiality (credential and passwd file exposed)
ATT&CK: T1552.001 (Credentials In Files), T1048.003 (Exfil over unencrypted protocol)
Severity: P2 — High (credential compromise + data exfiltration confirmed)
Recommendation: Disable FTP service; investigate 10.0.0.15 for compromise;
  rotate admin credential; check if 203.0.113.5 has other connections in network.

6. Common Mistakes

Mistake 1: Only checking TCP streams, ignoring UDP. DNS exfiltration, NTP-based C2, and SNMP data leaks are UDP. Run tshark -q -z io,phs first to see all protocols before filtering to TCP only.

Mistake 2: Failing to handle pcap-ng format. Modern captures use pcapng format. tshark handles both transparently. If a tool fails, check the format with file capture.pcap.

Mistake 3: Extracting only the first matching stream. Multiple FTP or HTTP sessions may be in the same PCAP. Always extract all streams, not just stream 0.

7. Practice Exercises

1. Open a PCAP (or simulate one) containing FTP traffic. Extract the username and password using the tshark commands from Section 2.2. What is the frame number of the PASS command?

2. You have a PCAP with HTTP traffic. tshark -q -z io,phs shows 847 HTTP packets and 3 DNS packets. What should you investigate first and why?

3. Write the tshark command that exports all HTTP objects from a PCAP to the directory /tmp/http_exported/.

8. Lab

Assessment mode: flag

challenge_spec_id: 6 — PCAP credential extraction

You are given capture.pcap containing HTTP traffic with Basic Authentication.

Task: 1. Use tshark to find packets with HTTP Authorization headers 2. Extract the Base64-encoded credential value 3. Decode it — the password is the flag in PREFIX{password} format

9. Framework Alignment

10. Further Reading

• Wireshark User Guide — https://www.wireshark.org/docs/wsug_html_chunked/
• tshark Man Page — man tshark; -z statistics options are exhaustive
• Practical Packet Analysis (3rd ed.) — Chris Sanders — The reference book for PCAP analysis
• NetworkMiner — GUI tool for PCAP protocol parsing; good for quick credential extraction

["Execute the five-step PCAP triage workflow to characterise the contents of an unknown PCAP and identify the primary protocols present", "Extract cleartext credentials from HTTP Basic Auth, FTP, and SMTP sessions using tshark commands and decode Base64-encoded values", "Write a complete PCAP investigation note including CIA impact, ATT&CK technique IDs, severity classification, and specific remediation recommendations"]

Prerequisites → Why this matters → PCAP triage workflow (5 steps) → Credential extraction (HTTP Basic Auth, FTP, SMTP, Telnet) → File extraction from PCAP → C2 detection in PCAPs → Writing a PCAP investigation note → Common mistakes → Practice exercises → Lab (flag, spec 6) → Framework alignment → Further reading