Wireshark Filter Info: Tips and Tricks for Analyzing Malicious Network Traffic

As a Threat Intelligence Analyst at Palo Alto Networks Unit 42, I regularly use Wireshark to review packet captures (pcaps) of network traffic generated by malware samples. To effectively analyze these malicious network traffic, it's essential to have a solid understanding of network traffic fundamentals and display filter expressions.

In this article, we'll explore some tips and tricks for using Wireshark filters to better analyze pcaps of malicious network traffic from infected Windows hosts.

Display Filter Expressions

To get the most out of your pcap analysis, it's crucial to use customized display filter expressions. Over time, I've developed a set of expressions that have proven useful in reviewing pcaps of malicious network traffic. These expressions can help you quickly identify patterns and anomalies in the data.

For example, one common expression I use is `tcp.port == 443 && http.request_method contains 'POST'` This filter allows me to focus on HTTPS traffic with POST requests, which are often used by malware to communicate with command and control (C2) servers.

Another useful expression is `udp.srcport == 67 && dhcp.option'3' == '192.168.1.100'` This filter helps me identify DHCP traffic related to malware infections, where the source port is 67 and the DHCP option contains a specific IP address.

Customized Wireshark Column Display

In addition to using display filter expressions, I also use a customized Wireshark column display to make my analysis more efficient. By creating custom columns for key fields such as protocol, source and destination ports, and packet lengths, I can quickly identify patterns in the data without having to dig through individual packets.

For example, one of the columns I've created is called 'Malware Flag,' which indicates whether a packet contains malware-related traffic or not. This allows me to quickly scan through large pcaps and focus on packets that require further analysis.

In this article, we've explored some tips and tricks for using Wireshark filters to analyze malicious network traffic from infected Windows hosts. By mastering display filter expressions and customizing your Wireshark column display, you can become a more effective analyst and uncover valuable insights into malware-related traffic.

Wireshark filter info