Investigate a Malware Infection

Analyze a real malware PCAP to identify an infected host as a SOC analyst.

Introduction

30 Second Summary

Every time a company gets hacked, the first responders are analysts who open up captured network traffic and piece together what happened. They trace connections, identify infected machines, and document the attack. This is one of the most in-demand skills in cybersecurity.

In this project, you will investigate a real malware infection captured in network traffic. You will use Wireshark and tshark to analyze a PCAP file, identify the compromised host, and write a professional incident report.

What You'll Build

You will complete a full traffic analysis investigation of a NetSupport Manager RAT infection using both a GUI tool and the command line.

By the end of this project, you'll have:

  • A working Wireshark and tshark installation configured for your Linux user.
  • A completed traffic analysis identifying the infected machine's IP address, MAC address, hostname, and user account.
  • A professional incident report documenting the infection in SOC analyst format.
  • Secret Mission: Build an automated IOC extraction script that pulls suspicious IPs, domains, and connection patterns from any PCAP file.

Are there any prerequisites?

You should have basic familiarity with the Linux command line (navigating directories, running commands). A basic understanding of networking concepts like IP addresses, ports, and TCP/UDP is helpful but not required.

Install and Configure Wireshark and tshark

Before you can investigate malicious traffic, you need the right tools installed on your Linux machine. Wireshark is the industry-standard packet analyzer used by security analysts in every SOC around the world.

In this step, you will install both Wireshark (the GUI) and tshark (its command-line counterpart), configure permissions so you can analyze traffic without sudo, and download the exercise PCAP file you will investigate throughout this project.

In this step, get ready to:
  • Install Wireshark and tshark on your Linux machine.
  • Configure non-root capture permissions so you can analyze traffic without elevated privileges.
  • Download and extract the exercise PCAP file from Malware-Traffic-Analysis.net.
Install Wireshark and tshark from the package manager

Wireshark provides a graphical interface for exploring packets visually. tshark gives you the same powerful filtering engine in the terminal, which is essential for scripting and automation.

  • Open your terminal.
  • Update your package lists by running this command:
sudo apt update
  • Install Wireshark and tshark by running these commands:
sudo apt install wireshark
sudo apt install tshark

Why two install commands?

On some Linux distributions, tshark is bundled with the Wireshark package. On others, it is a separate package. Running both commands ensures you have both tools regardless of your distribution.

During the Wireshark installation, a prompt may appear asking whether non-superusers should be allowed to capture packets.

  • If the prompt appears during installation, select Yes

What if I missed the prompt?

No worries. The next command explicitly triggers that same configuration dialog so you can set it up properly.

  • Configure non-root packet capture permissions by running:
sudo dpkg-reconfigure wireshark-common
  • When the dialog appears asking "Should non-superusers be able to capture packets?", select Yes and press Enter.

What does this do?

This command configures your system so that users in the wireshark group can capture and analyze network traffic without needing root access. Running security tools as root is a bad practice because it gives them unnecessary power over your system.

Seeing 'dpkg-reconfigure: command not found'?

This means you may not be on a Debian-based distribution (Ubuntu, Debian, Linux Mint). The dpkg-reconfigure command is specific to Debian-based systems.

help me configure non-root Wireshark capture on my Linux distribution

Add your user to the wireshark group and verify the installation

Even though you configured non-root capture, your user account needs to be added to the wireshark group before you can use that permission.

  • Add your current user to the wireshark group by running:
sudo usermod -a -G wireshark $USER

What does this command do?

The usermod -a -G command appends your user to the specified group without removing you from any other groups. $USER is an environment variable that automatically holds your current username.

Group membership changes do not take effect until you start a new session.

  • Log out of your Linux session completely, then log back in.

Closing the terminal is not enough

You need a full logout and login (or a system reboot) for the new group membership to activate. Simply closing and reopening a terminal window will not work.

  • After logging back in, open a new terminal and verify Wireshark is installed by running:
wireshark --version
  • Verify tshark is installed by running:
tshark --version

✔️ I see version numbers for both

You should see output starting with something like Wireshark 4.6.5 (your version may differ). Both tools are ready to use.

ⓧ I see 'command not found' or a permission error

If you see 'command not found', the installation may not have completed successfully.

  • Re-run sudo apt install wireshark and check for error messages in the output.
  • If you see a permission error instead, confirm you logged fully out and back in after running the usermod command.
  • Run groups in your terminal to check if wireshark appears in the list.

help me troubleshoot my Wireshark installation on Linux

Download the exercise PCAP file

You will analyze a real-world malware capture from Malware-Traffic-Analysis.net. This site provides free traffic analysis exercises using actual malicious network captures.

What is Malware-Traffic-Analysis.net?

It is a free resource that shares PCAP files containing real malware traffic. Security professionals use these exercises to practice their analysis skills in a safe environment. The PCAP files themselves are safe to open and analyze on any operating system.

  • Open your web browser and navigate to the exercise page:

https://www.malware-traffic-analysis.net/2026/02/28/index.html

This is the "Easy As 123" exercise from February 2026. It contains traffic from a NetSupport Manager RAT infection.

  • Find the download link for the zip file 2026-02-28-traffic-analysis-exercise.pcap.zip on the exercise page and download it.

The zip archive is password-protected. You need to find the password on the site's About page before you can extract it.

  • Open the About page in a new tab to find the zip password:

https://www.malware-traffic-analysis.net/about.html

  • Look for the section on the About page that describes how to open the password-protected zip archives. Note the password.

Now create a working directory and extract the PCAP file there.

  • Create a folder for your PCAP files by running:
mkdir -p ~/pcap
  • Move the downloaded zip file into your new folder by running:
mv ~/Downloads/2026-02-28-traffic-analysis-exercise.pcap.zip ~/pcap/

Downloaded to a different location?

If your browser saved the file somewhere other than ~/Downloads/, adjust the path in the mv command to match where your browser saved it.

  • Navigate to the pcap folder and extract the zip file by running:
cd ~/pcap
unzip 2026-02-28-traffic-analysis-exercise.pcap.zip
  • When prompted for the password, enter the password you found on the About page and press Enter.
  • Confirm the PCAP file was extracted by running:
ls ~/pcap/

You should see a .pcap file listed in the output alongside the zip archive.

Seeing 'incorrect password' or 'unzip: command not found'?

  • If you get an incorrect password error, double-check the password on the About page. Make sure you are typing it exactly as shown (passwords are case-sensitive).
  • If unzip is not found, install it by running sudo apt install unzip and try again.

help me extract the password-protected PCAP zip file

Your tools are installed and your PCAP file is ready. Next up, you will open this capture in Wireshark and start hunting for signs of the malware infection.

Get an Overview of the Traffic in Wireshark

Your tools are installed and your PCAP file is ready. Now it is time to start the actual investigation.

Before diving into individual packets, real analysts always start with an overview of the traffic. This tells you what protocols are present, which hosts are talking to each other, and where to focus your investigation.

In this step, get ready to:
  • Review the Protocol Hierarchy to see what types of traffic are in the capture.
  • Identify suspicious conversations between internal and external hosts.
  • Apply a display filter to isolate traffic to a suspicious external IP.
Open the PCAP and examine Protocol Hierarchy

The Protocol Hierarchy window gives you a bird's-eye view of every protocol in the capture. It shows the percentage of packets and bytes each protocol accounts for, so you can quickly spot what is worth investigating.

  • Open the PCAP file in Wireshark by running this command:
wireshark ~/pcap/2026-02-28-Easy-As-123-exercise.pcap &

What does this command do?

This opens Wireshark and immediately loads the PCAP file. The & at the end runs Wireshark in the background so your terminal stays usable.

Wireshark opens and displays the packet list. You should see hundreds of packets with various protocols in the Protocol column.

  • Click Statistics in the top menu bar.
  • Click Protocol Hierarchy.

A new window appears showing a tree of all protocols in the capture, with percentages for packets and bytes.

What should I see?

You should see protocols like HTTP, DNS, TLS, NBNS, and Kerberos listed in the hierarchy.

TLS traffic typically indicates encrypted web connections. DNS shows name resolution. NBNS and Kerberos are Windows network protocols that will help us identify the infected machine later.

  • Close the Protocol Hierarchy window by clicking Close.

Wireshark didn't open?

Make sure you logged out and back in after adding yourself to the wireshark group in Step 1. Group changes only apply to new login sessions.

If the file path is wrong, check that your PCAP file exists at ~/pcap/2026-02-28-Easy-As-123-exercise.pcap by running ls ~/pcap/ in your terminal.

Help me troubleshoot why Wireshark won't open my PCAP file on Linux

Use the Conversations window to find suspicious connections

The Conversations window shows you every pair of hosts that communicated during the capture. By looking at the TCP tab, you can see which internal machines connected to which external servers and how much data they exchanged.

  • Click Statistics in the top menu bar.
  • Click Conversations.
  • Click the TCP tab at the top of the Conversations window.

You now see a table of all TCP conversations. Each row shows two IP addresses, their ports, and the amount of data transferred.

  • Look for connections between an internal host on the 10.2.28.0/24 network and the external IP 45.131.214.85.
  • Note the port number the internal host is connecting to on 45.131.214.85. It should be TCP port 443.

Why is port 443 suspicious here?

Port 443 is normally used for HTTPS (encrypted web traffic). Malware often uses port 443 to blend in with legitimate traffic and avoid detection. The connection to 45.131.214.85 looks like normal HTTPS on the surface, but this IP belongs to the attacker's command-and-control server.

  • Note the internal IP address from the 10.2.28.0/24 subnet that is communicating with 45.131.214.85. This is the infected machine.
  • Close the Conversations window.

Can't find the connection to 45.131.214.85?

Try clicking the Bytes column header to sort conversations by data volume. The malware connection will typically have a noticeable amount of transferred data. You can also use Ctrl+F in the Conversations window to search for the IP.

Help me find specific IP conversations in Wireshark's Conversations window

Apply a display filter to isolate the attacker's traffic

Display filters let you hide all packets except the ones matching your criteria. By filtering for the attacker's IP, you remove the noise and see only the traffic between the infected host and the command-and-control server.

  • Click the display filter bar at the top of the Wireshark window. It shows a text field with a light green or white background above the packet list.
  • Type the following filter and press Enter:
ip.addr == 45.131.214.85

What does this filter do?

The ip.addr filter matches packets where either the source or destination IP is 45.131.214.85. This gives you a focused view of all communication between the infected host and the attacker's server.

The packet list now shows only traffic involving the suspicious IP. You should see the internal host's IP address in the Source or Destination column of every visible packet.

  • Confirm the internal IP address on the 10.2.28.0/24 subnet that appears in the filtered results. This is the infected machine you will investigate further in the next step.

Why start broad and narrow down?

SOC analysts follow this pattern for every investigation. Protocol Hierarchy gives you the big picture. Conversations shows you who is talking to whom. Display filters let you zoom into the suspicious activity.

This top-down approach prevents tunnel vision. If you jump straight to a specific packet, you might miss other malicious connections in the capture.

Filter bar turned red?

A red filter bar means Wireshark does not recognize your filter syntax. Check that you typed ip.addr == 45.131.214.85 with two equals signs and no extra spaces around the dots.

Help me fix my Wireshark display filter syntax

You now know which internal host is infected and which external server it is talking to. Next, you will dig deeper into the infected machine's identity using NBNS and Kerberos traffic.

Identify the Infected Host

You know which external IP is suspicious and which internal machine is talking to it. Now you need to figure out exactly who that internal machine belongs to.

In a real SOC investigation, just having an IP address is not enough. You need the hostname, MAC address, and the logged-in user account so the incident response team can physically locate and isolate the machine. Network protocols like NBNS and Kerberos leak this information into the traffic, and you can extract it with the right display filters.

In this step, get ready to:
  • Find the infected machine's hostname using NBNS traffic.
  • Find the Windows user account name using Kerberos traffic.
  • Document all four host details: IP, MAC address, hostname, and user account.
Filter for NBNS traffic to find the hostname

NBNS (NetBIOS Name Service) is a protocol Windows machines use to announce their hostnames on the local network. When a machine registers its name, that name appears in the NBNS packets.

  • Click on the display filter bar at the top of the Wireshark window (where you previously typed your last filter).
  • Clear the current filter and type nbns into the display filter bar.
  • Press Enter to apply the filter.
  • Look at the packets in the packet list pane. Find packets where the source IP is the infected host's address (the internal IP on the 10.2.28.0/24 network that you identified in the previous step).
  • Click on one of those NBNS packets from the infected host.
  • In the packet details pane (middle pane), expand the NetBIOS Name Service section, then expand Queries or Additional records.
  • Look for the Name field. This is the hostname of the infected machine.

What is NBNS?

NetBIOS Name Service is how Windows computers announce themselves on a local network. Every time a machine boots up or refreshes its registration, it broadcasts its hostname in NBNS packets.

This is incredibly useful for investigators because even if a machine is using DHCP (meaning its IP could change), the hostname stays constant and ties the traffic back to a specific computer.

Write down the hostname you found. You will need it for your incident report later.

Not seeing any NBNS packets?

Make sure you typed nbns in all lowercase in the display filter bar. Wireshark display filters are case-sensitive.

Check that the filter bar background turns green after you type it. A red background means Wireshark does not recognize the filter.

help me find NBNS packets in my Wireshark capture

Filter for Kerberos traffic to find the user account

Kerberos is the authentication protocol that Active Directory environments use. When a user logs in, their username travels across the network in Kerberos authentication packets.

  • Clear the display filter bar and type kerberos.CNameString into it.
  • Press Enter to apply the filter.
  • Look through the filtered packets for those coming from the infected host's IP address.
  • Click on a Kerberos packet from the infected host.
  • In the packet details pane, expand the Kerberos section.
  • Look for the CNameString field. This contains the Windows user account name that was logged in on the infected machine.

Why does Kerberos reveal the username?

In an Active Directory environment, every time a user authenticates or requests access to a resource, a Kerberos ticket request is sent. The CNameString field in these requests contains the client principal name, which is the username.

This is why SOC analysts love PCAP files from Active Directory networks. The authentication traffic gives you the exact user account that was compromised.

Write down the user account name. You may also see a full name in related Kerberos packets. Note that down too if visible.

Filter bar turning red?

The filter kerberos.CNameString is case-sensitive. Make sure the C, N, and S are capitalized exactly as shown.

If the filter bar stays red, your Wireshark version may not have the Kerberos dissector enabled. Try the broader filter kerberos first to confirm Kerberos packets exist in the capture.

help me troubleshoot my Kerberos display filter

Document the infected host details

You now have the hostname and user account. The last piece to collect is the MAC address, which identifies the physical network card in the infected machine.

  • Clear your display filter by clicking the X button at the right end of the filter bar. This shows all packets again.
  • Click on any packet where the infected host's IP address appears as the source.
  • In the packet details pane (middle pane), expand the Ethernet II layer at the very top of the protocol tree.
  • Find the Source field under Ethernet II. This is the MAC address of the infected machine.
  • Write down the MAC address. It will be in the format xx:xx:xx:xx:xx:xx.

Why collect the MAC address?

IP addresses can change (especially with DHCP), but MAC addresses are burned into the network card hardware. If the attacker changes the machine's IP or hostname, the MAC address still ties it back to the same physical device.

In incident response, the MAC address also helps the IT team locate the machine on the network switch port tables.

You should now have all four pieces of information about the infected host documented.

  • Confirm you have noted down: the IP address (from the 10.2.28.0/24 subnet), the MAC address (from the Ethernet II layer), the hostname (from NBNS), and the Windows user account name (from Kerberos).

Keep your notes organized

Open a text editor and record each detail on its own line. You will use these exact values when writing your incident report in the next step.

You have fully identified the infected host using just Wireshark's GUI. Next up, you will repeat this analysis using tshark on the command line to see how SOC analysts automate these same lookups.

Repeat the Analysis with tshark

You just identified the infected host using Wireshark's graphical interface.

Now you will replicate that exact same analysis using tshark, the command-line version of Wireshark. SOC analysts often use tshark to script repetitive analysis tasks and process captures on headless servers where no GUI is available.

In this step, get ready to:
  • List all TCP conversations to confirm the suspicious connection to 45.131.214.85.
  • Apply display filters to extract hostnames and usernames from the command line.
  • Use field extraction mode to produce a clean summary of attacker connections.
List all TCP conversations

The -z conv,tcp option in tshark produces a table of every TCP conversation in the capture, showing frame counts and byte totals for each direction. This is the command-line equivalent of the Conversations window you used in the Wireshark GUI.

  • Open a terminal window by pressing Ctrl+Alt+T.
  • List all TCP conversations in the PCAP by running this command:
tshark -r ~/pcap/2026-02-28-Easy-As-123-exercise.pcap -q -z conv,tcp

What do these flags do?

  • -r reads from a capture file instead of capturing live traffic.
  • -q enables quiet mode, suppressing per-packet output so only the statistics table appears.
  • -z conv,tcp generates a summary table of all TCP conversations with frame counts, byte totals, and duration.

You should see a table of TCP conversations. Scan the output for a row containing 45.131.214.85 on port 443. This confirms the same suspicious connection you found in Wireshark's GUI.

Not seeing any output?

Check that the file path is correct. The PCAP should be at ~/pcap/2026-02-28-Easy-As-123-exercise.pcap. If you get a "No such file" error, run ls ~/pcap/ to confirm the filename.

help me troubleshoot why tshark cannot read my PCAP file

Apply display filters for NBNS and Kerberos

The -Y flag applies the same display filter syntax you already used in the Wireshark GUI. You can reuse your exact filters from the previous step to pull out NBNS hostnames and Kerberos usernames.

  • Filter for NBNS traffic to find the infected host's hostname by running:
tshark -r ~/pcap/2026-02-28-Easy-As-123-exercise.pcap -Y "nbns"

You should see NBNS registration packets from the infected IP address. The hostname appears in the Info column of the output.

  • Filter for Kerberos traffic to find the Windows user account by running:
tshark -r ~/pcap/2026-02-28-Easy-As-123-exercise.pcap -Y "kerberos.CNameString"

You should see Kerberos authentication packets. The CNameString field contains the username you identified in the previous step.

Why use the same filters?

The -Y flag in tshark accepts the exact same display filter syntax as the Wireshark GUI. Every filter you learn in one tool works identically in the other.

Getting zero results from a filter?

Make sure you wrap the filter expression in double quotes. Without quotes, your shell may interpret special characters in the filter.

Check for typos in the filter name. The Kerberos filter is kerberos.CNameString with exact capitalization.

help me troubleshoot why my tshark display filter returns no results

Extract specific field values

Display filters show full packet summaries, which can be noisy. Field extraction mode lets you pull out only the specific values you care about. This produces clean, tab-separated output that is easy to read or pipe into other tools.

  • Extract source IP, destination IP, and destination port for all traffic involving the attacker by running:
tshark -r ~/pcap/2026-02-28-Easy-As-123-exercise.pcap -Y "ip.addr == 45.131.214.85" -T fields -e ip.src -e ip.dst -e tcp.dstport

What does this command do?

  • -Y "ip.addr == 45.131.214.85" filters to only show packets where either the source or destination IP is the attacker.
  • -T fields switches the output mode from packet summaries to specific field values.
  • -e ip.src -e ip.dst -e tcp.dstport specifies the three fields to extract. Each -e adds one column to the output.

You should see rows of tab-separated values. Each row shows the source IP, destination IP, and destination port for one packet. Look for the infected internal IP communicating with 45.131.214.85 on port 443.

Why is this useful for incident response?

Field extraction gives you clean, structured data you can paste directly into an incident report or pipe into scripts. In your next step, you will use these exact values to fill in the IOC section of your report.

Seeing blank fields in the output?

Blank fields appear when a packet matches the filter but does not contain the requested protocol field. For example, a UDP packet has no tcp.dstport. This is normal. Focus on the rows that show all three values populated.

help me understand why some tshark field extraction rows have blank columns

You now have all the infected host details and IOCs confirmed through both the GUI and the command line. Next up, you will pull everything together into a professional incident report.

Write Your Incident Report

You have identified the infected host, the attacker's infrastructure, and the malware involved. Now it is time to turn those raw findings into something actionable.

A professional incident report is the standard deliverable for a SOC analyst after completing an investigation. It tells the response team exactly who is compromised, what happened, and what to look for across the rest of the network.

In this step, get ready to:
  • Create a structured incident report file with three sections.
  • Document the infection timeline, victim details, and indicators of compromise.
  • Verify your findings against the official exercise answers.
Create the incident report file

SOC incident reports follow a predictable structure so that anyone on the team can quickly find the information they need. You will create a template with three sections: Executive Summary, Victim Details, and Indicators of Compromise.

  • Create the report file with section headers by running this command:
cat << 'EOF' > ~/pcap/incident-report.txt
=== INCIDENT REPORT ===
Date of Report: 2026-02-28
Analyst: [Your Name]

== EXECUTIVE SUMMARY ==


== VICTIM DETAILS ==

Hostname:
IP Address:
MAC Address:
User Account Name:
Full User Name:

== INDICATORS OF COMPROMISE (IOCs) ==

Attacker IP:
Attacker Port:
Protocol:
Malware Family:

EOF

What does this command do?

The cat << 'EOF' > file pattern is called a heredoc. It writes everything between the two EOF markers directly into the file. The single quotes around 'EOF' prevent the shell from interpreting any special characters inside the text.

The three sections mirror what real SOC teams use. Executive Summary gives the high-level story. Victim Details identifies the compromised machine. IOCs list the attacker's fingerprints so the team can hunt for them elsewhere on the network.

  • Confirm the file was created by running:
cat ~/pcap/incident-report.txt

You should see the full template with empty fields printed to your terminal.

File not found?

Make sure your ~/pcap/ directory exists. If you followed the earlier steps, it should already be there. If not, create it with mkdir -p ~/pcap and run the cat heredoc command again.

help me create my incident report file

Fill in the Executive Summary

The Executive Summary tells the reader what happened in plain language. It answers three questions: when did the activity occur, what type of malware was involved, and what did it do.

  • Open the report file in a text editor by running:
nano ~/pcap/incident-report.txt
  • In the == EXECUTIVE SUMMARY == section, write a short paragraph describing the incident. Include these details:
  • The date and time the malicious activity started: 2026-02-28 at 19:55 UTC.
  • The type of malware: NetSupport Manager RAT.
  • A brief description of what occurred: an internal Windows host was observed communicating with a known malicious IP address over an encrypted channel, consistent with command-and-control (C2) traffic from a remote access trojan.

What makes a good Executive Summary?

Write it so a manager who has never opened Wireshark can understand what happened. Avoid filter syntax or protocol abbreviations without explanation. One to three sentences is enough.

Example: "On 2026-02-28 at 19:55 UTC, SIEM alerts indicated NetSupport Manager RAT activity from an internal host communicating with 45.131.214.85 over TCP port 443. Traffic analysis confirmed the host was compromised and actively beaconing to the attacker's C2 server."

Complete the Victim Details and IOCs

The remaining two sections document the specific evidence you gathered during Steps 3 and 4. These are the facts that the response team uses to isolate the machine and block the attacker across the network.

  • In the == VICTIM DETAILS == section, fill in each field using the values you extracted from the PCAP:
  • Hostname: the name you found in the NBNS registration packets.
  • IP Address: the internal IP on the 10.2.28.0/24 network that connected to the attacker.
  • MAC Address: the hardware address from the Ethernet II header of packets sent by the infected host.
  • User Account Name: the Windows account from Kerberos CNameString packets.
  • Full User Name: the human-readable name associated with the account.
  • In the == INDICATORS OF COMPROMISE (IOCs) == section, fill in:
  • Attacker IP: 45.131.214.85.
  • Attacker Port: TCP 443.
  • Protocol: TLS over TCP (encrypted C2 channel).
  • Malware Family: NetSupport Manager RAT.
  • Save the file by pressing Ctrl+O then Enter, and exit nano by pressing Ctrl+X.
  • Review your completed report by running:
cat ~/pcap/incident-report.txt

You should see all fields filled in with the values you extracted from your analysis.

  • Verify your findings against the official answers. Open the exercise answers page in your browser:
xdg-open https://www.malware-traffic-analysis.net/2026/02/28/page2.html

What is on the answers page?

The answers are in a password-protected PDF zip file. Use the same password scheme from the site's About page that you used to extract the original PCAP. Download the PDF, extract it, and compare the official answers to the values in your report.

If any of your values differ from the official answers, go back to Wireshark or tshark and re-examine the relevant packets. Small discrepancies (like copying a MAC address with colons vs. dashes) are cosmetic, but the core values should match exactly.

Your answers don't match?

Double-check the IP address you filtered on in the Conversations window. The infected host is the internal machine on the 10.2.28.0/24 network that communicated with 45.131.214.85. If your hostname is wrong, re-run the nbns filter and look at queries originating from that specific IP. For the username, filter on kerberos.CNameString and confirm the source IP matches the infected host.

help me verify my incident report findings against the exercise answers

Your incident report is complete. You just produced the same deliverable that SOC analysts hand off to their incident response teams every day. Next up, you will take your tshark skills further by automating IOC extraction from any PCAP file.

Secret mission

Build an Automated IOC Extraction Script

You have manually investigated one PCAP file. But what if you had to triage 50 captures after a breach? Build a script that automates the tedious parts of IOC extraction so you can focus on the analysis that matters.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely locally on your Linux machine, so there are no ongoing costs. Decide whether to keep your tools installed for future analysis, or remove everything.

Resources you used:

  • Wireshark (GUI packet analyzer installed via apt).
  • tshark (command-line packet analyzer installed via apt).
  • Downloaded PCAP file and extracted archive.
  • Incident report text file.
  • Your user's membership in the wireshark group.

Keep everything running

No action needed. Choose this if you plan to analyze more PCAP files or continue practicing traffic analysis.

  • Wireshark and tshark stay installed and ready for your next investigation.
  • Your PCAP file and incident report remain in place for reference.
  • Your user stays in the wireshark group, so you can analyze traffic without sudo.

Pause - I'll come back to this later

Keep the tools installed but remove the exercise files to free up disk space.

  • Delete the downloaded PCAP file and zip archive from your working directory.
  • Keep Wireshark and tshark installed so you can jump back in without reinstalling.

Delete - I don't want to use this again

Remove all project files and uninstall the tools completely.

  • Delete the PCAP file, zip archive, and your incident report by running:
rm -f ~/Desktop/2026-02-28-traffic-analysis-exercise.pcap*
rm -f ~/Desktop/incident-report.txt
  • Remove your user from the wireshark group by running:
sudo deluser $USER wireshark
  • Uninstall Wireshark and tshark by running:
sudo apt remove wireshark tshark
  • Remove leftover configuration files by running:
sudo apt purge wireshark-common

What about the wireshark group itself?

The wireshark system group is removed automatically when you purge wireshark-common. No extra action needed.

That's a Wrap!

That's a Wrap!

Nice work. You just completed a real malware traffic investigation using both Wireshark and tshark. That is the exact workflow SOC analysts use every single day.

Here's what you accomplished:

  • Investigated a real NetSupport Manager RAT infection from captured network traffic using both the Wireshark GUI and the tshark command line.
  • Identified an infected host by correlating NBNS, Kerberos, and Ethernet header data to extract the machine's IP address, MAC address, hostname, and user account.
  • Produced a professional incident report documenting the infection with an Executive Summary, Victim Details, and Indicators of Compromise.
  • Built a reusable IOC extraction script that automatically pulls suspicious IPs, DNS queries, and unusual port activity from any PCAP file.

Ready to quiz yourself?