Network Forensics

Scope

What this is: Analysing network traffic captures (PCAP) to identify C2 communication, data exfiltration, and attack patterns.

Competition relevance: Digital forensics and incident response. Wireshark-based analysis.

Why it matters: Network traffic reveals attacker C2 channels, exfiltrated data, and lateral movement.

WSOS 2026 alignment: This topic directly supports Section 8: Investigation and digital forensics (analysing network evidence for attacker activity).

Competition area: Core to the digital forensics and incident response area, where you analyse network traffic to identify command-and-control servers, data exfiltration, and attack vectors.

Offline competence: Wireshark and tshark work entirely offline with local PCAP files. Use Wireshark’s built-in help and protocol reference. No network required for PCAP analysis.

---

Competency Matrix

Level	Expectation
Regional	Basic Wireshark filtering. Identify protocols. Extract files from HTTP.
National	Detect exfiltration patterns. Identify C2 traffic. Protocol analysis (DNS, HTTPS).
Squad/Team Selection	TLS decryption. Advanced protocol dissection. Anomaly detection.
International	Custom protocol analysis. Encrypted traffic fingerprinting.

---

Technical Content

PCAP Analysis

Loading PCAP in Wireshark:

wireshark capture.pcap &

Essential filters:

# HTTP traffic
http

# Specific IP
ip.addr == 192.168.1.100

# Specific port
tcp.port == 4444

# DNS queries
dns

# Failed connections (SYN without SYN-ACK)
tcp.flags.syn==1 and tcp.flags.ack==0 and not tcp.analysis.retransmission

Extract files from HTTP:

1. File → Export Objects → HTTP
2. Save suspicious files
3. Analyze with file, strings, xxd

Follow TCP stream:

1. Right-click packet → Follow → TCP Stream
2. View full conversation
3. Look for credentials, commands, flags

Competition context: Flags may be in HTTP responses, DNS queries, or extracted files. Check all protocols.

---

Command-Line Analysis (tshark):**

# Extract HTTP requests
tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri

# Extract DNS queries
tshark -r capture.pcap -Y "dns.qry.name" -T fields -e dns.qry.name | sort -u

# Find large uploads (potential exfiltration)
tshark -r capture.pcap -Y "http.request.method == POST" -T fields -e frame.len -e http.host

# Extract files
tshark -r capture.pcap --export-objects http,output/

---

Detecting C2 Traffic

Indicators:

• Regular beaconing (connections every X seconds)
• Unusual DNS queries (base64 in subdomain)
• HTTPS to non-standard ports
• High-entropy payloads (encrypted C2)

Finding beaconing:

# Statistics → Conversations → TCP
# Look for regular connection patterns

# Or with tshark:
tshark -r capture.pcap -T fields -e frame.time_relative -e ip.dst | sort | uniq -c

---

Exfiltration Detection

Large outbound transfers:

# Identify large uploads
tshark -r capture.pcap -Y "http.request.method == POST" -T fields -e http.content_length -e ip.dst | sort -rn

# Unusual protocols outbound
tshark -r capture.pcap -Y "ip.dst != 192.168.0.0/16" -T fields -e ip.proto | sort | uniq -c

DNS exfiltration:

# Long DNS queries (data in subdomain)
tshark -r capture.pcap -Y "dns.qry.name" -T fields -e dns.qry.name | awk 'length>50'

---

Competition Strategy & Marking

What gets marked:

• C2 server IPs identified with port numbers and protocol
• Exfiltrated data recovered and analysed
• Attack timeline from network perspective
• Extracted files analysed (hash, file type, content)

Evidence and reporting requirements:

• Wireshark screenshots showing malicious traffic with filters applied
• Exported objects (files from HTTP/FTP) with MD5/SHA1 hashes
• IP addresses, port numbers, and timestamps for all C2 communication
• TCP stream follow screenshots showing commands or data
• Statistics summary (Conversations, Protocol Hierarchy)
• Written analysis of traffic patterns (e.g., “Beaconing every 60 seconds to 203.0.113.5:443”)
• List of attacker techniques identified (DNS exfiltration, HTTP POST uploads, etc.)
• Clear naming: pcap_c2_traffic_203_0_113_5.png, pcap_extracted_malware.bin

Time allocation:

• PCAP import and initial filtering: 10 minutes
• HTTP file extraction: 15 minutes
• C2/exfil detection: 20 minutes

Time-boxed drill suggestion: 45-minute network forensics sprint: Given a PCAP file, apply filters to identify HTTP/HTTPS/DNS traffic, extract all HTTP objects, follow TCP streams to find flags or commands, identify C2 beaconing patterns, detect data exfiltration (large POST requests or suspicious DNS queries), and document all findings with screenshots and written analysis including attacker IP, C2 server IP, and timeline of network activity.

---

False Flags / Wrong Paths

Common Traps

Large PCAP files Don’t manually browse thousands of packets. Use filters aggressively.

Encrypted traffic TLS traffic is opaque without keys. Focus on metadata (IPs, timing, size).

Legitimate traffic Not all POST requests are exfiltration. Correlate with other evidence.

---

Practice Checklist

• Can apply Wireshark filters
• Can extract HTTP objects
• Can follow TCP streams
• Can identify C2 beaconing patterns
• Can detect exfiltration via size/frequency analysis
• Can use tshark for command-line analysis
• Complete PCAP analysis in under 30 minutes

---

References

• Regional Roadmap: Digital forensics
• National Roadmap: Digital forensics