Threat Hunting with Wireshark: Network Analysis & Security

Install and configure Wireshark on Windows, including components like Tshark and optional Npcap, and explore the built-in user guide and release notes.

Select the active network interface and configure Wireshark capture options, promiscuous mode, capture/display filters, coloring rules, and profiles for efficient threat hunting and streamlined packet analysis.

Enable promiscuous mode in Wireshark to observe frames beyond the host, aiding threat hunting by detecting scans, ARP spoofing, and unusual DNS behavior in switched networks.

Observe real-time network traffic with Wireshark to inspect device communications, identify anomalies, and understand application interactions, using live capture, interface selection, and deep packet inspection for threat hunting.

Explore the OSI model, a seven-layer framework for understanding network communication, and see how threat hunters map DNS traffic, ARP spoofing, and MAC-layer issues across layers.

Master the four-layer TCP/IP model and TCP, IP, and UDP traffic. Learn to use Wireshark to analyze source and destination IP, ports, and SYN packets for threat hunting.

Explore HTTP, DNS, FTP, and SMTP protocols, their ports and flows, and learn how threat hunters use Wireshark to detect anomalies, malware delivery, phishing, and data exfiltration.

Explore ip addressing, subnetting, cidr, and arp concepts to understand how packets reveal origins, destinations, and routing paths in threat hunting with Wireshark.

Learn how ports and services drive network communications, how attackers exploit open ports and uncommon port numbers, and how Wireshark analyzes port behavior, DNS, and TCP/UDP services for threat hunting.

Explore how a network packet comprises headers and payload, including Ethernet, IP, and TCP/UDP headers that enable local delivery, routing, and data, aiding threat hunters in spotting suspicious activity.

Explore how network data flows from client to server, using Wireshark to analyze DNS resolution, TCP handshakes, and packet payloads for threats.

Inspect the packet details pane in Wireshark to explore protocol headers and payload layer by layer, cross-checking MAC and IP addresses, DNS queries, and UDP data to detect suspicious activity.

Identify suspicious packets in Wireshark by analyzing abnormal IPs, unusual ports, malicious payloads, DNS activity and DGAs, and repeated connections to reveal threat behaviors.

Reassemble data streams in Wireshark to reconstruct TCP sessions, view complete conversations, and reveal credentials, malware payloads, and suspicious traffic patterns for threat hunting and incident response.

Leverage Wireshark's protocol hierarchy analysis to map protocol dependencies across network layers, inspect transport and session flows, and detect abnormal or hidden threats in multi-layer traffic.

Discover how the expert information feature in Wireshark helps threat hunters detect network errors, packet loss, suspicious retransmissions, and protocol anomalies by automatically highlighting key events.

Understand capture filters and display filters for Wireshark: capture filters run before capture using libpcap or bpf syntax to save packets, while display filters refine after capture to show traffic.

Master advanced filtering expressions in wireshark to isolate precise traffic patterns for threat hunting, using and, or, not, contains, and matches to detect malware, data exfiltration, and DNS tunnelling.

Learn to use Wireshark to filter malicious payloads with display filters, enabling threat hunting by isolating suspicious traffic and revealing malware, phishing, and command-and-control activity through protocol and payload inspection.

Identify malware traffic with Wireshark by starting a packet capture, establishing a baseline, applying capture filters, and analyzing DNS queries, HTTP/HTTPS connections, IP addresses, and TCP streams to extract IOCs.

Explore phishing as a social engineering threat and learn to detect impersonation and credential theft. Analyze email and traffic with Wireshark, focusing on SMTP, DNS, HTTP, POP3, and IMAP.

Analyze DDoS patterns using Wireshark to capture and inspect traffic, identify volume spikes, protocol filters, and flood types (SYN, UDP, HTTP), then mitigate and report.

Detect brute force attacks by analyzing repeated login failures in network traffic with Wireshark, and classify them as dictionary attacks, credential stuffing, password spraying, and exhaustive guessing using TCP filters.

Learn ARP spoofing and MITM attacks in network analysis with Wireshark, revealing forged ARP messages, traffic redirection, and credential exposure across HTTP, FTP, Telnet, and email protocols.

Detect covert DNS tunnelling channels by analyzing abnormal patterns, tracking encoded queries, and decoding payloads with Wireshark to expose hidden data transfers before damage occurs.

Identify anomalies by comparing traffic to established normality, inspect suspicious packets and protocols, follow streams, and generate alerts and reports for threat hunting using Wireshark.

learn how to define baseline network behaviour by monitoring normal communication patterns, protocols, and traffic; identify anomalies by comparing against established baselines using tools like Wireshark.

Identify indicators of compromise using Wireshark by capturing and analyzing network traffic, filtering protocols, and correlating suspicious IPs, domains, and payloads with threat intelligence.

Correlate multiple packets in Wireshark to reconstruct sessions and reveal attacker actions across sequences, including port scanning, brute force attempts, data exfiltration, and command and control activity.

Analyze encrypted traffic with Wireshark to detect threats using a structured workflow: identify TLS/HTTPS traffic, inspect certificates and IPs, and spot beaconing and indicators of compromise.

Extract files from network traffic with Wireshark, analyze HTTP objects, emails, and payloads from PCAP captures, generate cryptographic hashes, and practice safe malware analysis in a threat-hunting workflow.

Analyze http objects in Wireshark by filtering for get requests and 200 ok, export http objects, and inspect file types, hosts, and sha-256 hashes with VirusTotal for analysis.

Capture email traffic with Wireshark, filter SMTP, POP3, and IMAP, reconstruct streams, extract attachments, and generate file hashes for malware analysis and phishing threat hunting.

Explore a threat-hunting workflow with Wireshark to detect malicious activity in network traffic. Capture packets, filter protocols, reconstruct streams, and inspect payloads to identify indicators of compromise for incident response.

Learn to use Wireshark for threat hunting by analyzing network traffic to detect exploit kits, malicious redirects, and payload delivery with IOC generation.

Integrate Wireshark with Snort and Suricata to combine real-time packet capture with signature-based detection and alerts, enabling in-depth traffic analysis, threat hunting, and incident response.

Explore how to export and integrate data from networks into SIEM platforms, using structured logging, smart alerting, and threat correlation with Wireshark for faster detection and response.

Explore Tshark, the command line counterpart to Wireshark, enabling packet capture and network analysis for threat hunting from the terminal, including installation, verification, interface selection, capture, filtering, and exporting results.

Learn proactive threat hunting by analyzing network traffic with Wireshark, detecting indicators of compromise, and investigating incidents to strengthen organizational security.

Develop best practices for proactive threat hunting through planning, continuous monitoring, and using Wireshark with capture and display filters, packet captures, baselines, and threat intelligence feeds to detect anomalies.

Stay current in threat hunting by leveraging Wireshark communities and security networks, including Discord, mailing lists, blogs, SharkFest, and the Internet Storm Center, for updates and training.