Wireshark for the SOC

Handed a .pcap file instead? Skip to C.

1. Open Wireshark — Start menu, type Wireshark, Enter. If it can't see any interfaces, close it and reopen as Administrator.
2. The welcome screen lists your network interfaces, each with a small live activity graph. The one that's moving is normally Wi-Fi or Ethernet.
3. Optional — record only what you need: click the …using this filter box and type a capture filter such as host 10.0.0.42 or port 443. Leave it blank to capture everything, which is usually the safer choice in an incident.
4. Double-click the interface. Capture starts at once — packets scroll in the top pane and the toolbar shows a red square.
5. Reproduce the activity you're investigating, or let it run for the time window you need.
6. Stop the capture: click the red square in the toolbar, or press Ctrl+E.

1. File → Save As (Ctrl+Shift+S).
2. Choose a folder, name it something you'll recognise later — case1234-web.pcapng — leave the type as pcapng, click Save.
3. Always work on a copy. File → Save As once more to make a working duplicate, so the original stays untouched while you cut packets out of the copy.

1. File → Open (Ctrl+O) and pick the .pcap / .pcapng — or drag the file straight onto the Wireshark window.
2. Set the clock to UTC so timestamps line up with every other log: View → Time Display Format → UTC Date and Time of Day.
3. View → Time Display Format → Seconds Since Previous Displayed Packet is the other useful mode — it shows gaps between packets, which is how you eyeball a beacon interval.

1. Statistics → Capture File Properties: note the time span and total packet count so you know the scale of what you're looking at.
2. Statistics → Protocol Hierarchy: scan the protocol mix. Anything you didn't expect — IRC, TFTP, SMB heading to the internet, raw TCP on an odd port — is your first lead.
3. Statistics → Conversations, then click the Bytes column header to sort. This is "who talked to whom, and how much." Note the largest flows and any external IP you don't recognise.
4. Right-click the row for an interesting flow → Apply as Filter → Selected → A↔B to pull just that conversation into the main window.
5. Statistics → Endpoints → Map plots the external IPs on a world map — quick sanity check on where traffic is going.

1. Click the display-filter bar, or press Ctrl+/ to jump to it.
2. Type an expression and press Enter. The bar turns green when the syntax is valid, red when it isn't, yellow when it's legal but probably not what you meant.
3. Build a filter without typing it: click a value in the middle (details) pane, then right-click → Apply as Filter → Selected. Use …and Selected / …or Selected from the same menu to stack conditions.
4. Turn a field into a permanent column: right-click it in the details pane → Apply as Column. Do this with the TLS Server Name so every HTTPS row shows its destination.
5. Clear the filter with the X at the right of the bar. Nothing was deleted — every packet comes straight back.

1. Click a row in the top (packet list) pane. The other two panes follow it.
2. Middle pane is the decode, outer layer to inner: Frame → Ethernet → IP → TCP/UDP → the application protocol. Click the > to expand one layer.
3. Open an entire layer at once: right-click it → Expand Subtrees.
4. Bottom pane is the raw bytes. Click any field in the middle pane and its bytes highlight below — that's how you confirm a value is genuinely in the packet and not inferred.
5. Ctrl+. and Ctrl+, step to the next / previous packet in the same conversation.

1. Right-click any packet in the flow → Follow → TCP Stream (or HTTP / TLS / UDP Stream).
2. The window shows the exchange in order — one colour for client→server, another for server→client. A TLS stream shows the handshake in clear, then ciphertext.
3. Change Show data as to Hex Dump for binary protocols, or Raw to save the payload out to a file.
4. The dropdown at the bottom-left steps through every stream of that type in the capture.
5. Close the window — the filter tcp.stream eq <n> stays applied, so you're now looking at just that one conversation. Clear the bar to zoom back out.

1. File → Export Objects → HTTP (also SMB, IMF for email, TFTP, DICOM).
2. The list is every file seen in that protocol, with hostname, type and size. Click a row to jump to the packets that carried it.
3. Select one and click Save, or Save All to a folder. Treat anything you pull as hostile — scan it, don't open it.

1. Click each packet that matters and press Ctrl+M — a black bar marks it.
2. Right-click → Packet Comment, write what the packet shows, OK. The note is saved inside the pcapng and travels with the file.
3. File → Export Specified Packets → choose Marked packets only → save a small evidence file (case1234-evidence.pcapng).
4. For each marked packet, write down: the frame number, the 5-tuple (src IP:port → dst IP:port, protocol), and the UTC timestamp. A finding that doesn't point at specific packets can't be reproduced.