Analyze Network Traffic with Wireshark

Hunt through a real malware PCAP to identify an infected host and trace C2 traffic.

Introduction

30 Second Summary

Every device on a network leaves a trail of data packets behind it. When malware infects a machine, that trail becomes the evidence a security analyst uses to figure out what happened.

In this project, you will step into the role of a SOC analyst investigating a real malware infection. Using Wireshark, you will analyze a packet capture to identify the infected host, trace command-and-control traffic, and write a professional incident report.

What You'll Build

Picture opening your GitHub repository and showing someone a polished incident report where you traced real malware traffic from a raw packet capture to the exact infected machine, the attacker's server, and a table of every indicator of compromise.

By the end of this project, you'll have:

An analysis of a real malicious PCAP file where you use Wireshark display filters to slice through thousands of packets and identify exactly which machine on a network is infected.
A traced C2 (command-and-control) path from the infected host to the attacker's server, with a timeline mapping when the attack started and stopped.
A professional incident report with victim details, an IOC table, and actionable recommendations, pushed to GitHub as a portfolio piece that proves you can investigate real threats.
An optional Secret Mission to push your skills further.

Are there any prerequisites?

This project includes setup instructions for all required tools. No prior cybersecurity experience is needed.

Before We Start

Before any hands-on work begins, take a moment to commit to what you are building and why it matters. Grounding yourself in the mission now makes every filter and finding purposeful once the real packets start flying.

Set Up Your Analysis Environment

Your investigation starts here. Before you can hunt through packets, you need three things in place: a working copy of Wireshark, the actual malware traffic capture to analyze, and a repository to publish your findings.

In this step, you'll verify your Wireshark installation, download a real malicious PCAP file from malware-traffic-analysis.net, and set up a GitHub repository for your incident report.

In this step, get ready to:

Verify Wireshark opens and shows a version number.
Download and extract the malicious PCAP file.
Create a GitHub repository and link it to a local project folder.

Verify Wireshark is working

Wireshark is the industry-standard packet analyzer you'll use to slice through the PCAP file. Let's confirm it launches before going any further.

Press Cmd+Space (macOS) or the Windows key (Windows) to open your search bar.
Type Wireshark and press Enter to open it.
Wireshark should launch and show a welcome screen listing your network interfaces.
Click Help in the menu bar, then click About Wireshark.
Note the version number in the dialog. You should see 4.6.x or 4.4.x (any recent stable version works for this project).
Close the About dialog. Leave Wireshark open.

✔️ I see the welcome screen and a version number

Wireshark is ready to go. You'll use it to open the PCAP file in the next step.

ⓧ Wireshark won't open or isn't installed

Download the stable release from the official Wireshark download page.
Run the Windows x64 installer. The installer includes Npcap, which is required for live packet capture.
Accept the default options and complete the installation.
Search for Wireshark again and open it. You should now see the welcome screen.

Download and extract the malicious PCAP

The PCAP file you'll investigate comes from malware-traffic-analysis.net, a well-known resource for real-world traffic analysis exercises. The file is distributed as a password-protected ZIP to prevent accidental execution.

Open your browser and navigate to the exercise page:

https://malware-traffic-analysis.net/2026/02/28/index.html

Click the download link for 2026-02-28-traffic-analysis-exercise.pcap.zip (5.2 MB). Save it to your Downloads folder.

Why is the ZIP password-protected?

The archive contains real malware traffic. Password-protecting it prevents antivirus software from automatically quarantining or deleting the file before you can analyze it.

You need the password to extract the ZIP. The site publishes its password scheme on its About page.

Open the About page in your browser:

https://www.malware-traffic-analysis.net/about.html

Look for the section that describes the password for ZIP archives. Note it down. You'll need it in a moment.

To extract the password-protected ZIP, you need 7-Zip. Let's check if it's installed.

Press the Windows key to open your search bar.
Type 7-Zip and look for 7-Zip File Manager in the search results.

✔️ I see 7-Zip File Manager in the results

7-Zip is installed. You're ready to extract the PCAP.

ⓧ I don't see 7-Zip

Download the free installer from https://7-zip.org.
Click the .exe download link for 64-bit Windows x64.
Run the installer and accept the defaults.
Search for 7-Zip again. You should now see 7-Zip File Manager in the results.

Now extract the PCAP file from the downloaded ZIP.

Open File Explorer and navigate to your Downloads folder.
Right-click 2026-02-28-traffic-analysis-exercise.pcap.zip.
Select 7-Zip, then click Extract Here.
When prompted, enter the password you found on the About page.
You should now see 2026-02-28-traffic-analysis-exercise.pcap in your Downloads folder.

Don't see the extracted file?

Double-check the password. The malware-traffic-analysis.net About page shows the exact password to use.
Make sure you selected Extract Here, not Open archive. Opening the archive only previews the contents without extracting.
If your antivirus quarantined the file, add an exception for your Downloads folder and re-extract.

Still stuck? Help me extract the password-protected PCAP ZIP with 7-Zip

Create the project folder and GitHub repository

You need a dedicated folder to hold your analysis files and a GitHub repository to publish your finished incident report as a portfolio piece.

Open Git Bash by pressing the Windows key, typing Git Bash, and pressing Enter.
Create the project folder and move into it by running these commands:

mkdir -p ~/Projects/wireshark-netsupport-rat
cd ~/Projects/wireshark-netsupport-rat

Move the extracted PCAP file into the project folder by running:

mv ~/Downloads/2026-02-28-traffic-analysis-exercise.pcap .

Confirm the file is in the right place by running:

ls

You should see 2026-02-28-traffic-analysis-exercise.pcap listed in the output.

Don't see the PCAP file after running ls?

Check that the file name matches exactly. The mv command is case-sensitive.
If the file downloaded to a different location, adjust the source path. Run ls ~/Downloads/*.pcap to check if it's there.

Still stuck? Help me move my PCAP file into the project folder using Git Bash

Now create the remote repository on GitHub where you'll publish your findings.

Open your browser and go to https://github.com/new.
In the Repository name field, type wireshark-netsupport-rat.
Set the visibility to Public.
Do not check Add a README file. Leave all initialization options unchecked.
Click Create repository.

GitHub shows a quick setup page for your new empty repository. Keep this page open.

Switch back to Git Bash. Initialize a local Git repository by running:

git init

Link your local repository to the GitHub remote by running:

git remote add origin https://github.com/Jaybee124/wireshark-netsupport-rat.git

Before you move on, what do you expect to see when you check which remotes are configured?

Verify the remote is set correctly by running:

git remote -v

You should see two lines, both pointing to https://github.com/Jaybee124/wireshark-netsupport-rat.git (one for fetch, one for push).

Not seeing the remote URL?

Make sure you ran git init before git remote add origin. Without git init, there is no repository to add a remote to.
Confirm you are inside the wireshark-netsupport-rat folder by running pwd.

Still stuck? Help me link my local Git repo to my GitHub remote

Your analysis environment is ready. You have Wireshark open, the malicious PCAP sitting in your project folder, and a GitHub repository waiting for your findings. Next up, you'll crack open the PCAP and see what thousands of packets of real malware traffic actually look like.

Explore the PCAP and Hit the Wall

Your analysis environment is ready and the PCAP file is sitting in your project folder. Now it is time to load it into Wireshark and see what real malware traffic looks like.

Every SOC analyst faces the same challenge when they first pull a packet capture from a flagged alert. Thousands of packets fill the screen with no clear signal pointing to the infected machine.

In this step, get ready to:

Open the PCAP file in Wireshark and see raw network traffic.
Review the scenario context from the SIEM alert.

Open the PCAP in Wireshark

The PCAP file contains a full recording of network traffic captured during the infection. Loading it in Wireshark displays every packet that crossed the wire.

Switch back to Wireshark.
Click File in the menu bar.
Click Open.
Navigate to your project folder at C:\Users\YourName\Projects\wireshark-netsupport-rat.
Select 2026-02-28-traffic-analysis-exercise.pcap and click Open.

The packet list pane fills with rows of network traffic. Look at the status bar at the very bottom of the Wireshark window to see the total packet count.

Not seeing any packets?

Make sure you selected the .pcap file, not the .zip file. The ZIP must be extracted first using 7-Zip with the password from the site's About page.

If the file appears corrupted, delete it and re-download from the exercise page, then extract again.

Wireshark won't load my PCAP file

Scroll through the packet list pane.

What am I looking at?

Each row in the packet list is one network packet captured on the wire. The columns show the packet number, timestamp, source IP, destination IP, protocol, and a summary of the packet contents.

You will see a mix of protocols: DNS queries, TCP handshakes, HTTP requests, and TLS encrypted connections. Traffic flows between many different IP addresses.

You will notice traffic from multiple internal IPs in the 10.2.28.0/24 range. Before you spend more time scrolling, take a guess. Do you think you can identify which host is infected just by reading the raw packet headers?

You cannot. DNS queries, TCP handshakes, HTTP requests, and TLS connections all blend together with no signal pointing to one compromised machine.

Review the scenario context

Before diving deeper, you need to know what triggered this investigation. A SIEM (Security Information and Event Management) system flagged suspicious traffic. Here is what the alert tells you.

The alert identified NetSupport Manager RAT (Remote Access Trojan) command-and-control traffic from an external IP: 45.131.214[.]85 over TCP port 443.
The C2 (Command and Control) activity started on 2026-02-28 at 19:55 UTC.
The LAN segment is 10.2.28[.]0/24 with the domain easyas123[.]tech.
The Active Directory domain controller is at 10.2.28[.]2 (EASYAS123-DC).
The LAN gateway is at 10.2.28[.]1.

What is a SIEM?

A SIEM collects logs and alerts from across a network. It correlates events and flags suspicious patterns so analysts do not have to watch every packet manually.

In this scenario, the SIEM did the heavy lifting of noticing the malware signature. Your job is to dig into the raw traffic and confirm the details.

Your task is to find five pieces of information about the infected Windows client: its IP address, MAC address, hostname, Windows user account name, and the user's full name.

Look back at the raw packet list in Wireshark. Can you answer any of those five questions from what you see right now?

You cannot. Staring at thousands of unfiltered packets gives you no efficient way to extract any of those details. This is the exact problem that display filters solve.

You have seen the wall. Thousands of packets, zero answers. In the next step, you will learn the display filters that cut through the noise and reveal the infected host in seconds.

Identify the Infected Host with Display Filters

You have seen the raw traffic. Thousands of packets from multiple hosts, and no way to tell which machine is infected just by scrolling.

Wireshark display filters solve that problem. Each filter narrows the packet list down to a single protocol, letting you extract one piece of victim information at a time. In this step, you will use four filters to identify the infected host's IP address, MAC address, hostname, user account name, and full name.

In this step, get ready to:

Find the infected host's IP and MAC address using DHCP traffic.
Confirm the hostname using NBNS traffic.
Extract the user account name and full name using Kerberos and LDAP.

Find the infected host's IP and MAC address using DHCP traffic

Every device on a network needs an IP address. DHCP is the protocol that assigns them. When a host requests an IP from the DHCP server, that conversation gets captured in the PCAP. Those packets contain the client's MAC address and the IP it was assigned.

In the Wireshark display filter bar at the top of the window, click inside the text field.
Type dhcp and press Enter. The filter bar turns green when the filter is valid.

The packet list now shows only DHCP packets. The thousands of packets you saw before are hidden, not deleted.

What is a display filter?

A display filter hides packets that do not match your criteria. The underlying capture file stays untouched. You are just changing which packets are visible in the list. To remove a filter later, click the X button next to the filter bar or delete the text and press Enter.

Look at the Info column in the packet list. Find a packet that says DHCP Request or DHCP ACK from a host in the 10.2.28.0/24 range.
Skip any packets from 10.2.28.1 (the gateway) or 10.2.28.2 (the domain controller). You are looking for a client machine.
Click on a DHCP packet from a client to select it.

The middle section of the Wireshark window is the packet details pane. It shows the selected packet's protocol layers in a collapsible tree.

In the packet details pane, click the arrow next to Ethernet II to expand it.
Note the source MAC address displayed here. Write it down.
Expand the Dynamic Host Configuration Protocol section in the same pane.
Find and expand Option: (50) Requested IP Address. This shows the IP address the client was assigned. Write it down.
Find and expand Option: (12) Host Name. This shows the hostname the client reported. Write it down as a bonus confirmation for the next substep.

Why does DHCP reveal so much?

When a Windows client joins a network, it broadcasts a DHCP Request asking for an IP address. That broadcast includes the client's hardware MAC address in the Ethernet frame and often includes the client's hostname as an option. The DHCP server's ACK confirms the assigned IP.

For a SOC analyst, DHCP traffic is the fastest way to map an IP address to a physical device on the network.

You should now have three pieces of information written down: the infected client's IP address, its MAC address, and a preliminary hostname from the DHCP Host Name option.

Not seeing DHCP packets?

Make sure the filter bar says exactly dhcp in lowercase, and that you pressed Enter to apply it. If the bar background is red, the filter has a typo.

If you see DHCP packets but none from a client in the 10.2.28.0/24 range, scroll through the full list. The packet you need may not be the first one displayed.

Help me find the DHCP packets that reveal the infected host's IP and MAC address.

Confirm the hostname using NBNS traffic

You spotted a hostname in the DHCP option, but NBNS provides a second confirmation. Windows machines regularly broadcast their hostnames over NBNS, so filtering for it gives you independent verification.

Click inside the display filter bar and clear the current filter.
Type nbns and press Enter.
Look at the Info column. NBNS packets display the hostname being broadcast.
Find packets from the IP address you identified in the previous substep. The hostname in the Info column should match what you saw in the DHCP Host Name option.
Write down the confirmed hostname.

What is NBNS?

NBNS stands for NetBIOS Name Service. It is how older Windows machines announce their hostnames on the local network. Even modern Windows systems use it. For SOC analysts, it is a reliable second source for mapping an IP to a hostname.

You now have three confirmed pieces of information: the infected host's IP address, its MAC address, and its hostname. Two more to go.

NBNS hostname does not match DHCP?

Double-check that you are looking at NBNS packets from the same IP address you found in the DHCP step. If a different IP is broadcasting a different hostname, you may be looking at a different machine on the network.

Help me match the NBNS hostname to my DHCP findings.

Extract the user account name and full name using Kerberos and LDAP

You know which machine is infected. Now you need to find out who was logged in. Kerberos authentication traffic contains the Windows user account name, and LDAP traffic reveals the user's full name.

Clear the current filter in the display filter bar.
Type kerberos.CNameString and press Enter.

This filter shows only Kerberos authentication packets that contain a client name field.

Click on the first frame in the filtered results.
In the packet details pane, expand the Kerberos section by clicking the arrows until you find the CNameString field.
Scroll through the frames in the packet list. Look for a CNameString that is a human-readable username. Skip any entries that end in $ because those are machine accounts, not human users.
Write down the user account name.

Why skip names ending in $?

In Active Directory, every computer has a machine account whose name ends with a dollar sign. For example, a computer named WORKSTATION1 has the machine account WORKSTATION1$. These are not human users. You are looking for a plain username like jsmith or rene.mccollum.

Now grab the last piece of victim information: the user's full name.

Clear the current filter.
Type ldap contains "CN=Users" and press Enter.
Look at the Info column. You should see entries that contain a CN= value showing the full name of the user.
Write down the full name.

What does LDAP reveal here?

LDAP is the protocol that Active Directory uses to look up user and group information. When a machine queries the domain controller for user details, the response includes fields like CN= (Common Name), which is the user's full display name. This gives you the human-readable name behind the account.

No results for the Kerberos or LDAP filter?

Make sure kerberos.CNameString is typed with the exact capitalisation shown. The field name is case-sensitive.

For the LDAP filter, make sure the quotes around CN=Users are straight double quotes, not curly quotes. Copy-pasting from some applications can introduce curly quotes that Wireshark does not recognise.

Help me find the user account name and full name from the PCAP.

Before you move on, do you think you have all five victim details? Try listing them from memory before checking your notes.

You should have all five pieces of information written down: the infected host's IP address, its MAC address, its hostname, the Windows user account name, and the user's full name. If any are missing, go back to the relevant filter and find the value.

You know WHO is infected. Next up, you will trace WHAT the malware did by following the C2 traffic to the attacker's server and extracting Indicators of Compromise.

Trace the C2 Traffic and Extract IOCs

You now know who is infected. You have an IP address, a MAC address, a hostname, a user account, and a full name. But you still don't know what the malware actually did on the network.

In this step, you will trace the C2 (Command and Control) traffic between the infected host and the attacker's server. You will extract Indicators of Compromise (IOCs) and build a timeline of the attack. This is exactly what incident responders need to contain and remediate a threat.

In this step, get ready to:

Filter for C2 traffic to the known malicious IP and follow the TCP stream.
Hunt for additional suspicious external connections and DNS queries from the infected host.
Build an IOC table and timeline in a new incident-report.md file.

Filter for traffic to the known malicious IP

The SIEM alert told you the C2 server is at 45.131.214[.]85. That is your first hunting target. A display filter can isolate every packet that touches that IP.

In Wireshark, click the display filter bar at the top of the window.
Type the following filter and press Enter:

ip.addr == 45.131.214.85

Before you look at the results, think about what you expect to see. The alert said this IP communicated with an internal host over TCP port 443. Do you expect the traffic to look like normal HTTPS web browsing, or something different?

You should see TCP connections between the infected internal host and 45.131.214.85 over port 443. Even though port 443 is normally used for HTTPS, NetSupport Manager RAT uses it for its own protocol.

Look at the Time column for the first and last packets in this filtered view.
Write down both timestamps. These define the window of C2 activity in the capture.

Now let's see what the malware was actually sending and receiving.

Right-click on one of the TCP packets in the packet list.
Select Follow, then TCP Stream.

A new window opens showing the raw data exchanged between the two hosts. You may see plaintext or binary data instead of a TLS handshake. This confirms the traffic is not standard HTTPS.

What is Follow TCP Stream?

Wireshark reassembles all the individual packets in a TCP connection and displays them as a single continuous conversation. The client side is shown in one colour and the server side in another.

For legitimate HTTPS traffic, you would see a TLS handshake at the top. NetSupport Manager RAT skips TLS entirely and sends its own binary protocol. That is a strong IOC on its own.

Close the TCP Stream window to return to the main Wireshark view.

Not seeing any packets after applying the filter?

Check that you typed the IP address exactly as ip.addr == 45.131.214.85 with two equals signs. A single equals sign is a syntax error in Wireshark's display filter language.
Make sure the filter bar background is green after pressing Enter. A red or yellow background means the filter has a typo.
Help me troubleshoot my Wireshark display filter for the C2 IP address.

Hunt for additional malicious traffic

The known C2 IP is one piece of the puzzle. Malware often communicates with more than one external server. It may reach out to additional C2 nodes, download payloads from separate domains, or exfiltrate data elsewhere.

Filter for all traffic from the infected host to destinations outside the LAN by typing this filter and pressing Enter:

ip.src == [[INFECTED_HOST_IP="your infected host's IP address"]] && !ip.dst == 10.2.28.0/24

What does this filter do?

ip.src == shows only packets sent FROM the infected host.
!ip.dst == 10.2.28.0/24 excludes packets going to other internal hosts on the LAN. What remains is everything the infected machine sent to the outside world.

Review the Destination column and the Info column. Look for connections to IPs that are not the gateway (10.2.28.1) or domain controller (10.2.28.2).
Write down any additional suspicious external IPs, ports, and domains you find.

Now check what domain names the infected host looked up around the time of infection.

Filter for DNS queries from the infected host by typing this filter and pressing Enter:

dns && ip.src == [[INFECTED_HOST_IP="your infected host's IP address"]]

Look at the Info column for domain names that were queried around the time of the infection (near 19:55 UTC).
Write down any domains that look suspicious. These could be additional C2 domains or payload delivery URLs.

Spotting suspicious domains

Legitimate domains (like microsoft.com or windowsupdate.com) are expected in normal Windows traffic. Focus on domains you do not recognise, domains with unusual names, or domains queried right before the C2 communication started.

Filter bar turning red?

Make sure you replaced the placeholder with the actual IP address you identified in Step 3 (for example, 10.2.28.x where x is the number you found).
Check for spaces around the && operator. The filter needs a space before and after &&.
Help me fix my Wireshark display filter for external traffic from the infected host.

Build your IOC table

Everything you have found so far exists only in your notes and in Wireshark's temporary filter views. It is time to put it into a permanent, structured document that an incident response team could pick up and act on.

Open your project folder at C:\Users\YourName\Projects\wireshark-netsupport-rat.
Create a new file called incident-report.md in a text editor. You can right-click inside the folder, select New, then Text Document, and rename the file to incident-report.md (make sure file extensions are visible so you can remove .txt).
Paste the following Markdown template into incident-report.md:

# Incident Report: NetSupport Manager RAT Infection

## Indicators of Compromise

| Type | Value | Description |
|------|-------|-------------|
| IP Address | 45.131.214[.]85 | NetSupport Manager RAT C2 server |
| Port | TCP/443 | C2 communication port |
| [Type] | [your-finding] | [description of what you found] |

## Timeline

| Time (UTC) | Event |
|------------|-------|
| 2026-02-28 19:55 | SIEM alert triggered for NetSupport Manager RAT |
| [your-finding] | First observed C2 packet in PCAP |
| [your-finding] | Last observed C2 packet in PCAP |

What does this file do?

The IOC table records every malicious indicator you found: IPs, ports, and domains. The first two rows are pre-filled from the SIEM alert. The third row is where you add the additional IOCs you discovered in your hunt.
The Timeline section uses the timestamps you noted from the C2 filter to establish exactly when the attack started and how long it lasted in the capture.
The IP address is written as 45.131.214[.]85 with brackets around the dot. This is called defanging. It prevents security tools and email clients from accidentally treating the IP as a clickable link.

Replace every [your-finding] placeholder with the actual values you discovered during your analysis. Add one row for each additional IOC you found (extra suspicious IPs, ports, or domains).
Replace the Timeline placeholders with the first and last packet timestamps you wrote down from the C2 filter.
Save incident-report.md.

Confirm the file was created by opening Git Bash and running:

ls

You should see both 2026-02-28-traffic-analysis-exercise.pcap and incident-report.md listed in the output.

Don't see incident-report.md in the output?

Make sure Git Bash is in the correct folder. Run pwd to check your current directory. It should show your wireshark-netsupport-rat project folder.
Check that the file was not accidentally saved as incident-report.md.txt. In File Explorer, click View and check File name extensions to see hidden extensions.
Help me find my incident-report.md file in the project folder.

✔️ Awesome, I've got everything!

Double check you have saved incident-report.md with your actual findings filled in.

ⓧ I'd like to double check the full code

Your incident-report.md should follow this structure. The [your-finding] placeholders should be replaced with the values you discovered in Wireshark.

# Incident Report: NetSupport Manager RAT Infection

## Indicators of Compromise

| Type | Value | Description |
|------|-------|-------------|
| IP Address | 45.131.214[.]85 | NetSupport Manager RAT C2 server |
| Port | TCP/443 | C2 communication port |
| [Type] | [your-finding] | [description of what you found] |

## Timeline

| Time (UTC) | Event |
|------------|-------|
| 2026-02-28 19:55 | SIEM alert triggered for NetSupport Manager RAT |
| [your-finding] | First observed C2 packet in PCAP |
| [your-finding] | Last observed C2 packet in PCAP |

You have traced the C2 traffic, hunted for additional malicious connections, and documented everything in a structured IOC table with a timeline. Next up, you will complete the full incident report with victim details, an executive summary, and recommendations, then push everything to GitHub as a portfolio piece.

Write the Incident Report and Push to GitHub

You have traced the C2 traffic to the attacker's server, identified IOCs, and built a timeline of the infection.

The analysis is worthless if it stays in your head or scattered across notes. A professional incident report is how SOC analysts communicate findings to incident responders, management, and other teams. In this step, you will turn your findings into a structured Markdown report, capture Wireshark screenshots as evidence, and push everything to GitHub as a cybersecurity portfolio piece.

In this step, get ready to:

Complete the incident report with an Executive Summary, Victim Details, Analysis Evidence, and Recommendations.
Create a README and capture Wireshark screenshots as evidence.
Commit and push everything to GitHub.

Complete the incident report

Your incident-report.md currently has an IOC table and a Timeline from Step 4. A professional incident report needs more structure so that anyone reading it can quickly understand what happened, who was affected, and what to do next.

Open incident-report.md in your text editor.
Find the line that says # Incident Report: NetSupport Manager RAT Infection.
Add the following Executive Summary and Victim Details sections directly below that heading, above the existing ## Indicators of Compromise section:

## Executive Summary

On 2026-02-28 at approximately 19:55 UTC, SIEM alerts identified NetSupport Manager RAT command-and-control activity originating from an internal host on the EASYAS123 network (10.2.28[.]0/24). The infected host communicated with an external C2 server at 45.131.214[.]85 over TCP port 443. This report documents the victim host details, indicators of compromise, and recommended remediation actions.

## Victim Details

| Field | Value |
|-------|-------|
| IP Address | [your-finding] |
| MAC Address | [your-finding] |
| Hostname | [your-finding] |
| User Account | [your-finding] |
| Full Name | [your-finding] |

What do these sections do?

The Executive Summary gives anyone reading the report a one-paragraph overview: what happened, when, and how serious it is.
The Victim Details table collects the five pieces of information you identified in Step 3: IP address, MAC address, hostname, user account, and full name. Replace each [your-finding] with the actual values from your notes.

Replace each [your-finding] in the Victim Details table with the values you wrote down in Step 3.
Save incident-report.md.
Scroll to the top of the file. You should see the sections in this order: Executive Summary, Victim Details, Indicators of Compromise, Timeline.

Sections in the wrong order?

Make sure you pasted the Executive Summary and Victim Details above the ## Indicators of Compromise heading, not below it. The report should read top to bottom: Summary, Victim, IOCs, Timeline.

Help me fix the section order in my incident report.

Now you need to add sections that connect your analysis back to the evidence. These go at the bottom of the report, below the Timeline.

Scroll to the bottom of incident-report.md, below the Timeline table.
Add the Analysis Evidence section by pasting this below the Timeline:

## Analysis Evidence

### DHCP Traffic - Host IP and MAC Identification

![DHCP Filter](screenshots/dhcp-filter.png)

### NBNS Traffic - Hostname Identification

![NBNS Filter](screenshots/nbns-filter.png)

### Kerberos Traffic - User Account Identification

![Kerberos Filter](screenshots/kerberos-filter.png)

### C2 Traffic to 45.131.214[.]85

![C2 Traffic](screenshots/c2-traffic.png)

What are these image references?

Each ![alt text](path) line is Markdown image syntax. It tells GitHub to display a screenshot inline when someone views your report. You will take these screenshots and save them to a screenshots/ folder in the next substep.

Save incident-report.md.
Scroll through the file. You should now see six sections: Executive Summary, Victim Details, Indicators of Compromise, Timeline, Analysis Evidence.

The last section gives the reader actionable next steps for containing the infection.

Add the Recommendations section below Analysis Evidence by pasting this at the bottom of the file:

## Recommendations

1. Isolate the infected host immediately to prevent lateral movement.
2. Block 45.131.214[.]85 at the perimeter firewall.
3. Reset credentials for the compromised user account.
4. Run a full endpoint scan on the infected host.
5. Review logs for any lateral movement from the infected host to other systems on the 10.2.28[.]0/24 network.
6. Conduct a review of other hosts for similar NetSupport Manager RAT indicators.

Why include recommendations?

An incident report without recommendations leaves the reader knowing what happened but not what to do about it. These six actions cover the immediate containment priorities: isolate the host, block the attacker, and check for spread.

Save incident-report.md.
Scroll through the entire file from top to bottom. You should see seven sections in this order: Executive Summary, Victim Details, Indicators of Compromise, Timeline, Analysis Evidence, Recommendations.

Missing a section?

Check that each section starts with ## followed by a space and the section name. A missing # or extra space can break Markdown heading formatting.

Help me check my incident report structure.

✔️ Awesome, I've got everything!

Great. Make sure you have saved incident-report.md and that all [your-finding] placeholders in the Victim Details table are replaced with your actual values from Step 3.

ⓧ I'd like to double check the full code

Scroll through your incident-report.md and confirm these sections appear in order, each starting with a ## heading:

Executive Summary with a paragraph describing the incident.
Victim Details with a table of five fields (IP, MAC, Hostname, User Account, Full Name) filled with your findings.
Indicators of Compromise with a table of IOCs from Step 4.
Timeline with timestamps from Step 4.
Analysis Evidence with four image references (DHCP, NBNS, Kerberos, C2 traffic).
Recommendations with six numbered action items.

Create the README and take screenshots

A README is the first thing anyone sees when they visit your GitHub repository. It tells them what the project is, what skills it demonstrates, and where to find the important files.

Create a new file called README.md in your project folder (wireshark-netsupport-rat).
Paste the following content into README.md:

# Network Traffic Analysis: NetSupport Manager RAT

## Overview

This project documents the analysis of a malicious packet capture (PCAP) containing NetSupport Manager RAT command-and-control traffic. The analysis was performed using Wireshark to identify the infected host, trace C2 communications, and extract Indicators of Compromise.

## Scenario

A SIEM alert flagged signature hits for NetSupport Manager RAT from 45.131.214[.]85 over TCP port 443. A packet capture was retrieved for the internal host that triggered the alert. This report documents the investigation.

## Skills Demonstrated

- PCAP analysis with Wireshark
- Display filter usage (DHCP, NBNS, Kerberos, LDAP, DNS)
- Infected host identification (IP, MAC, hostname, user account)
- C2 traffic analysis and timeline reconstruction
- IOC extraction and documentation
- Professional incident report writing

Continue adding to README.md by pasting this directly below the Skills Demonstrated list:

## Tools Used

- Wireshark
- Git / GitHub

## Files

- `incident-report.md` - Full incident report with findings
- `screenshots/` - Wireshark analysis evidence

## Source

PCAP from [malware-traffic-analysis.net](https://malware-traffic-analysis.net/2026/02/28/index.html) - "Easy as 123" traffic analysis exercise.

What does this README cover?

The README describes what you analyzed (NetSupport Manager RAT traffic), what tools you used (Wireshark), and what skills this project demonstrates. It also credits the source of the PCAP file from malware-traffic-analysis.net.

When a hiring manager visits your GitHub, this README is the first thing they see. It should immediately tell them this is a real analysis, not a tutorial copy-paste.

Save README.md.
Confirm the file exists by switching to Git Bash and running:

ls

You should see README.md alongside incident-report.md and the PCAP file in the output.

✔️ Awesome, I've got everything!

Great. Double check that README.md is saved with all six sections (Overview through Source).

ⓧ I'd like to double check the full code

Scroll through your README.md and confirm these sections appear in order, each starting with a ## heading:

Overview with a paragraph about the PCAP analysis.
Scenario describing the SIEM alert.
Skills Demonstrated with six bullet items.
Tools Used listing Wireshark and Git/GitHub.
Files listing incident-report.md and screenshots/.
Source linking to malware-traffic-analysis.net.

Now you need to capture the Wireshark evidence your report references. Each screenshot proves a specific step in your analysis.

Create the screenshots folder by running this in Git Bash:

mkdir screenshots

Switch back to Wireshark where the PCAP is still open.
Type dhcp in the display filter bar and press Enter.
Take a screenshot of the Wireshark window showing the DHCP filter results.
Save it as dhcp-filter.png inside the screenshots/ folder.
Change the display filter to nbns and press Enter.
Take a screenshot and save it as nbns-filter.png in screenshots/.
Change the display filter to kerberos.CNameString and press Enter.
Take a screenshot and save it as kerberos-filter.png in screenshots/.
Change the display filter to ip.addr == 45.131.214.85 and press Enter.
Take a screenshot and save it as c2-traffic.png in screenshots/.

Take clear screenshots

Make sure the display filter bar, the packet list, and the packet details pane are all visible in each screenshot. This gives the viewer full context for what the filter revealed.

Confirm all four screenshots are saved by running this in Git Bash:

ls screenshots/

You should see c2-traffic.png, dhcp-filter.png, kerberos-filter.png, and nbns-filter.png listed.

Screenshots folder is empty?

Make sure you saved the screenshots inside the screenshots/ folder that is inside your wireshark-netsupport-rat project folder. If you saved them to the Desktop or Downloads by mistake, move them into the screenshots/ folder now.

Help me find where my screenshots went.

Commit and push to GitHub

Before you commit, you need to make sure the PCAP file does not get pushed to GitHub. It is too large and contains actual malware traffic.

Create a .gitignore file in your project folder with the following content:

*.pcap
*.zip
quarantine/

Why exclude these files?

*.pcap keeps the large PCAP file out of the repository. PCAP files with malware traffic should not be shared publicly without safeguards.
*.zip excludes the original password-protected ZIP download.
quarantine/ prevents any extracted malware samples (from the Secret Mission) from being pushed.

Save .gitignore.
Stage and commit all your files by running these commands in Git Bash:

git add .
git commit -m "Add incident report for NetSupport Manager RAT PCAP analysis"

What does git add . do?

git add . stages every file in the current folder for the next commit. Because you created a .gitignore, Git automatically skips the PCAP file, ZIP file, and quarantine folder. Only your report, README, screenshots, and .gitignore get committed.

Before you push, think about what you expect to see when you visit the GitHub repository. Will the PCAP file appear? Will the screenshots be visible in the report?

Push your commit to GitHub by running these commands:

git branch -M main
git push -u origin main

What do these commands do?

git branch -M main renames your default branch to main (the GitHub convention).
git push -u origin main uploads your commit to the remote GitHub repository and sets origin main as the default push target for future commits.

Push rejected or authentication error?

GitHub no longer accepts passwords for Git operations. If you see an authentication error, you need to use a Personal Access Token (PAT) instead. Go to GitHub, click your profile icon, then Settings, then Developer settings, then Personal access tokens to generate one.

Help me fix my Git push authentication error.

Open your browser and visit your repository at https://github.com/Jaybee124/wireshark-netsupport-rat.
Confirm that you can see incident-report.md, README.md, .gitignore, and the screenshots/ folder listed in the repository.
Confirm that the PCAP file is not listed. The .gitignore kept it out.
Click on incident-report.md. GitHub renders the Markdown, so you should see your formatted report with headings, tables, and your screenshots displayed inline.

Secret mission

Extract Files and Add Hashes

Your incident report is solid, but real SOC analysts go deeper. They extract the actual malware payloads from the packet capture so they can be submitted to sandbox environments and matched against known malware databases. Can you extract the transferred files and add their SHA256 hashes to your IOC table?

Clean Up Your Resources

This project runs entirely locally with a free GitHub repository, so there are no ongoing costs. Decide whether to keep your resources, pause them to come back later, or delete them entirely.

Your quarantine folder contains real malware

The quarantine/ folder holds files you exported from a real malicious PCAP. These are actual malware samples sitting on your disk. If you no longer need them for analysis, delete the folder to remove any risk.

Resources you used:

Local project folder wireshark-netsupport-rat containing the PCAP file, quarantine/ malware samples, incident report, and screenshots.
GitHub repository wireshark-netsupport-rat under your account.
7-Zip (if you installed it during this project for extracting the password-protected ZIP).

Keep everything running

No action needed. Choose this if you want to keep your analysis files and GitHub portfolio piece intact for future reference or job applications.

Your GitHub repository stays live as a cybersecurity portfolio piece.
The PCAP file remains in your local folder for further analysis practice.
The quarantine/ folder contains real malware samples. Be aware these files are on your disk. Do not open or execute them.
7-Zip stays installed on your machine. It is a general-purpose archive tool you may find useful for other projects.

Pause - I'll come back to this later

Close Wireshark to free up system resources while keeping your files for later.

Close Wireshark if it is still open.
Consider deleting the quarantine/ folder since it contains real malware samples. Your findings are already documented in incident-report.md.
Your local project folder, GitHub repository, and 7-Zip remain available when you return.

Delete - I don't want to use this again

Remove all project resources and start fresh.

Delete the local project folder. In Git Bash, navigate to the parent directory that contains wireshark-netsupport-rat and run:

cd ~/Projects
rm -rf wireshark-netsupport-rat

This removes the PCAP, the quarantine/ malware samples, your incident report, screenshots, and all other project files.

Delete the GitHub repository. Go to your repository at github.com/Jaybee124/wireshark-netsupport-rat.
Click Settings in the repository navigation bar.
Scroll down to the Danger Zone section.
Click Delete this repository and follow the confirmation prompts.
Uninstall 7-Zip if you installed it for this project and no longer need it. Open Windows Settings.
Go to Apps.
Search for 7-Zip, select it, and click Uninstall.

Nice Work!

Nice work! You just investigated real malware traffic like a SOC analyst, hunting through a Wireshark packet capture to identify an infected host, trace C2 traffic, and document your findings in a professional incident report.

You've learned how to:

Analyze a real malicious PCAP file containing NetSupport Manager RAT traffic, using display filters (dhcp, nbns, kerberos.CNameString, ldap contains "CN=Users") to identify an infected Windows host's IP, MAC, hostname, user account, and full name.
Trace C2 traffic to an attacker's server, extract Indicators of Compromise, and write a professional incident report with an Executive Summary, Victim Details, IOC table, Timeline, and Recommendations.
Push your analysis to a GitHub repository as a cybersecurity portfolio piece that proves you can investigate real threats and document findings like a SOC analyst.
Secret Mission: Extract transferred files from the PCAP and add their SHA256 hashes to your IOC table.

Ready to quiz yourself?