Network Forensics: PCAP Analysis for Investigators

Prerequisites

• DFA-K002: Forensic Imaging
• FND-K003: Networking Fundamentals

Why This Lesson Matters

Network captures are the closest thing digital forensics has to CCTV footage. Every packet, every conversation, every credential transmitted in cleartext is preserved. A PCAP from the time of an incident can answer questions that no other artefact can: exactly what data was sent to an attacker, what commands the malware executed, and what the victim's machine said when the attacker was watching.

1. PCAP as a Forensic Artefact

1.1 Sources of PCAPs in an Investigation

IDS/IPS sensors         → full packet capture at network ingress/egress
Network TAPs            → passive mirrors on critical segments
SPAN ports              → switch port mirroring
Host-based capture      → tcpdump/Wireshark on the endpoint (if running before incident)
Cloud flow logs         → AWS VPC Flow Logs, Azure NSG Flow Logs (metadata only, not content)
NDR appliances          → full session recording for east-west traffic

1.2 Preserving a PCAP as Evidence

# Hash immediately on collection
sha256sum incident_capture.pcap > incident_capture.pcap.sha256
cat incident_capture.pcap.sha256

# Verify at any time
sha256sum -c incident_capture.pcap.sha256
# incident_capture.pcap: OK

2. Forensic Triage Workflow

Step 1: Orientation — what protocols and volumes are present?
  tshark -r capture.pcap -q -z io,phs      # protocol hierarchy
  tshark -r capture.pcap -q -z endpoints,ip # all communicating IPs

Step 2: Identify the investigative window
  tshark -r capture.pcap -T fields -e frame.time | head -1   # first packet
  tshark -r capture.pcap -T fields -e frame.time | tail -1   # last packet

Step 3: Isolate relevant traffic
  tshark -r capture.pcap -Y "ip.addr == 185.220.101.5"       # attacker IP
  tshark -r capture.pcap -Y "http || ftp || smtp || telnet"   # cleartext protocols

Step 4: Extract evidence
  Credentials, file transfers, commands, C2 payloads

Step 5: Document
  IP pairs, timestamps, protocols, evidence extracted, frame numbers

3. Credential Extraction

3.1 HTTP Basic Auth

tshark -r capture.pcap -Y "http.authorization" 
  -T fields -e frame.number -e frame.time -e ip.src -e ip.dst -e http.authorization

# Decode the Base64 credential
echo "dXNlcjpzM2NyZXQ=" | base64 -d
# user:s3cret

3.2 FTP

# FTP sends USER and PASS in cleartext on port 21
tshark -r capture.pcap -Y "ftp.request.command == USER || ftp.request.command == PASS" 
  -T fields -e frame.time -e ftp.request.command -e ftp.request.arg

3.3 SMTP AUTH

tshark -r capture.pcap -Y "smtp.auth.username || smtp.auth.password" 
  -T fields -e frame.time -e smtp.auth.username -e smtp.auth.password

4. File Extraction from PCAPs

4.1 HTTP File Downloads

# Export all HTTP objects (files downloaded over HTTP)
tshark -r capture.pcap --export-objects http,/cases/IR-001/http_exports/
ls -la /cases/IR-001/http_exports/

# Hash each recovered file
for f in /cases/IR-001/http_exports/*; do sha256sum "$f"; done

4.2 FTP Data Transfers

tshark -r capture.pcap --export-objects ftp-data,/cases/IR-001/ftp_exports/

# Alternatively: find the FTP data stream and follow it
tshark -r capture.pcap -Y "ftp" -T fields -e frame.time -e ftp.request.command -e ftp.request.arg
# Note the PASV port, then filter for data on that port
tshark -r capture.pcap -Y "tcp.port == <pasv_port>" -q -z follow,tcp,raw,0

4.3 SMB File Access

# List all SMB file operations
tshark -r capture.pcap -Y "smb2" 
  -T fields -e frame.time -e smb2.filename -e smb2.cmd

# Export SMB objects
tshark -r capture.pcap --export-objects smb,/cases/IR-001/smb_exports/

5. Reconstructing Attacker Sessions

For protocols like Telnet or HTTP where the session is human-readable, reconstruct the full conversation:

# Find all TCP streams in the capture
tshark -r capture.pcap -T fields -e tcp.stream | sort -u | wc -l

# Follow a specific stream as ASCII
tshark -r capture.pcap -q -z follow,tcp,ascii,3

# Client → server is shown in one colour; server → client in another
# For Telnet: the reconstructed stream shows every command typed

6. PCAP Repair

Sometimes a PCAP is truncated or has corruption (common with high-speed capture or disk pressure).

# Check and repair with pcapfix
pcapfix corrupt.pcap
# Creates repaired.pcap

# Or use Wireshark's capinfos to check integrity
capinfos capture.pcap
# Reports: file type, captured packets, any errors

7. Building a Network Evidence Summary

For each significant finding in the PCAP, document:

Network Evidence Item — NE-001
File: incident_capture.pcap (SHA-256: a3f9b2...)
Analyst: Alice Martin | Date: 2026-06-08 17:00 UTC

Stream:     TCP stream 3
IP pair:    10.0.0.42:49221 → 185.220.101.5:443
Protocol:   HTTPS (TLS 1.3)
Time:       2026-06-08 14:31:15 → 14:58:32 UTC
Duration:   27 minutes 17 seconds

Significance:
  Outbound TLS connection from WS-042 to known C2 IP 185.220.101.5.
  27-minute session duration consistent with C2 beaconing/interaction.
  Content encrypted (TLS 1.3); payload not extractable without session keys.
  Corroborates Sysmon Event 3 (same IP pair, same timestamp).

ATT&CK: T1071.001 — Application Layer Protocol: Web Protocols (C2)

8. Common Mistakes

Mistake 1: Only following stream 0. Complex PCAPs contain hundreds of TCP streams. Stream 0 is the first connection — not necessarily the most relevant. Always check all streams.

Mistake 2: Not hashing extracted files. A file extracted from a PCAP is derivative evidence. It must be hashed and documented, just like a recovered deleted file.

Mistake 3: Assuming encrypted = no evidence. Even encrypted sessions provide: duration, volume, timing, IP pairs, TLS fingerprint (JA3), and SNI hostname. All of these are evidence.

9. Practice Exercises

1. tshark -q -z io,phs shows 847 HTTP packets and 12 FTP packets. Which protocol do you investigate first and why?

2. You follow an HTTP stream and find a file download. The file is 3.2 MB. Write the command to export it and the command to hash it.

3. A PCAP contains only TLS traffic to 185.220.101.5. You cannot decrypt it. List three pieces of evidence you can still extract from the PCAP.

10. Lab

Assessment mode: flag

challenge_spec_id: 6 — PCAP credential extraction

You are given capture.pcap with HTTP traffic.

Task: 1. Filter for HTTP Authorization headers 2. Extract and decode the Base64 credential 3. The password is the flag: PREFIX{password}

11. Framework Alignment

12. Further Reading

• Wireshark User Guide — https://www.wireshark.org/docs/wsug_html_chunked/
• "Practical Packet Analysis" — Chris Sanders — Best introductory PCAP book
• NetworkMiner — Passive network forensics tool; extracts files, credentials, messages from PCAPs automatically

["Execute the five-step PCAP forensic triage workflow to characterise an unknown capture and identify the three most relevant protocol streams", "Extract cleartext credentials from HTTP Basic Auth and FTP sessions using tshark, and export all HTTP file transfers to a case directory with individual SHA-256 hashes", "Produce a network evidence summary for a described PCAP finding that includes stream number, IP pair, protocol, duration, forensic significance, and ATT&CK technique ID"]

Prerequisites → Why this matters (CCTV analogy) → PCAP as forensic artefact (sources, preservation) → Triage workflow (5 steps) → Credential extraction (HTTP, FTP, SMTP) → File extraction (HTTP, FTP, SMB) → Session reconstruction → PCAP repair → Network evidence summary template → Common mistakes → Practice exercises → Lab (flag, spec 6) → Framework alignment → Further reading