Answer six questions from one capture

applied · 90 min · Objective 1.3

Task

Take a single long capture of your own lab and answer six specific questions from it, each requiring a different tool technique. Objective 1.3 is using the tools, and the test of that is not knowing the flags -- it is getting an answer out of data that was not collected with your question in mind.

Steps

  1. Merge your earlier captures into one file so the data is mixed, the way real capture is: mergecap -w /tmp/all.pcap /tmp/*.pcap.
  2. Answer each question, recording the command and the answer:
  3. Which host pair exchanged the most bytes, and in which direction?
  4. What server names were requested, across all protocols?
  5. Which connection had the most regular timing?
  6. Was any credential or session token transmitted in clear text?
  7. Which conversations were never completed -- SYNs with no SYN/ACK?
  8. What is the single longest-lived connection, and what was it?
  9. For each, note whether the answer required a display filter, a statistics view, or following a stream.
  10. Now answer a question the capture cannot settle: what file was downloaded over TLS? Write down exactly why it cannot, and what would have to change.
  11. Produce a one-page summary of the capture as though handing it to another analyst, with the six answers and the one refusal.

Verify

tshark -r /tmp/all.pcap -q -z conv,tcp | head -10
tshark -r /tmp/all.pcap -T fields -e tls.handshake.extensions_server_name -Y "tls.handshake.type==1" | sort -u
tshark -r /tmp/all.pcap -Y "tcp.flags.syn==1 && tcp.flags.ack==0" -T fields -e ip.dst | sort | uniq -c | sort -rn | head -5
tshark -r /tmp/all.pcap -q -z io,phs | head -20

The conversation table answers question one and the protocol hierarchy answers "what is in here at all", which is the command to run first on any unfamiliar capture. The SYN count per destination gives you both the beaconing answer and the incomplete-connection answer from the same data.

Notes

The refusal in step 4 is the part to get right. "The capture cannot tell you" is a complete and professional answer, and it is the same statement as "no evidence of X is not X did not happen" in the form a packet analyst meets it.

Run the protocol hierarchy first, every time. An analyst who starts with a display filter is answering the question they brought; the hierarchy tells you what questions the data can support.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.