Exposing a Network-Based Attack: TryHackMe First Shift CTF — Task 7: The Crown Jewel
Network Traffic Analysis and Forensics to Identify C2 Channels, ARP Spoofing, and Data Exfiltration Techniques
Wireshark Traffic Analysis: Identifying Hosts: DHCP, NetBIOS and Kerberos
Practical examples of how to use Wireshark to answer specific questions about network activity
Exploring Network Traffic Analysis with Packet Captures
In the world of network security, analyzing packet captures is an essential skill for identifying issues, troubleshooting, and detecting malicious activity.
This article presents several practical examples of how to use Wireshark traffic analysis to answer specific questions about network activity, focusing on identifying hosts based on various protocols. These insights can aid in diagnosing issues, detecting unauthorized devices, and ensuring proper network configuration.
Question 1: What is the MAC address of the host “Galaxy A30”?
Process:
dhcp.option.hostname contains "Galaxy"
Answer:
9a:81:41:cb:96:6c
Question 2: How many NetBIOS registration requests does the “LIVALJM” workstation have?
Process:
nbns.name contains LIVALJM and nbns.flags.opcode==Registration
Answer:
16
Question 3: Which host requested the IP address “172.16.13.85”?
Process:
dhcp.option.requested_ip_address == 172.16.13.85
Answer:
Galaxy-A12
Question 4: What is the IP address of the user “u5”? (Enter the address in defanged format.)
Process:
kerberos.SNameString == u5
Answer:
10[.]1[.]12[.]2
Question 5: What is the hostname of the available host in the Kerberos packets?
Process:
kerberos.CNameString contains $
Answer:
xp1$
Conclusion
In network traffic analysis, extracting specific pieces of data such as IP addresses, MAC addresses, or NetBIOS requests can be essential for understanding and securing a network. By utilizing tools like Wireshark or other packet capture software, you can gain valuable insights into the behavior and configuration of devices on your network. Mastering these techniques will not only help you troubleshoot issues but also detect anomalies that could indicate potential security threats.
