Advanced Packet Analysis -Wireshark & TShark

Triage alerts, reassemble streams, extract files, and detect protocol abuse via Wireshark & TShark.

Disclaimer: This blog post is based on a walkthrough hosted on TryHackMe and it is intended for educational purposes only.

Learning Objectives

By the end of this room, you will be able to:

• Explain the relationship between Wireshark and TShark and describe when CLI-based analysis is preferable to a GUI
• Navigate Wireshark’s protocol dissection tree to extract investigatively relevant fields
• Follow TCP and UDP streams to reconstruct application-layer communications
• Extract files, credentials, and other artifacts from packet captures
• Identify exfiltration patterns, protocol tunneling, and protocol abuse in network traffic
• Write TShark commands for field extraction, filtering, and automated evidence processing

🛠️ Type: Walkthrough

👤 Role: SOC Analyst

💪 Difficulty: Medium

🔗Link: https://tryhackme.com/room/advancedpacketanalysis

source: https://tryhackme.com/room/advancedpacketanalysis

All evidence is preloaded:

• The investigation PCAP for all tasks: /home/ubuntu/captures/investigation.pcap
• Helper scripts: /home/ubuntu/scripts/
• Threat feed and reference material: /home/ubuntu/references/

Wireshark is installed on the desktop for graphical tasks.

TShark is available at the command line.

How many unique destination IPs does 10.14.22.88 scan inside the capture window?

How many plain HTTP beacon requests from 10.14.22.88 to 194.165.16.56 are present in the capture?

What is the request URI that every HTTP beacon from 10.14.22.88 targets?

What command does the base64 value in the cmd field decode to?

Following the FTP control stream from the investigation PCAP, what password is transmitted in cleartext?

What PowerShell command in the reverse shell packages the Documents folder?

Following the 302 redirect chain, what is the name of the malicious file accessed from the compromised machine?

Using Export Objects > HTTP, extract the executable from the investigation PCAP. What is its SHA256 hash?

What is the SHA256 hash of the 5.3 MB archive POSTed to 185.213.154.201?

Which malware family does the cross-reference against threat_feed.txt assign to the extracted executable?

What is the subject CN on the exported C2 certificate?

What JA4 fingerprint does every Client Hello to the C2 host produce?

t13d040400_98dd3bb0ed34_34f36fd09b12

Run the DNS tunnel hunting filter on the PCAP. What parent domain do the long-subdomain queries target?

How many unique external IPs does extract_iocs.sh write to external_ips.txt?