Wireshark for Network Forensics: Packet Analysis Guide

In 2023, the 3CX supply chain attack went undetected for weeks partly because defenders lacked visibility into abnormal DNS and HTTPS patterns leaving their network. Wireshark — a free, open-source packet analyzer — is one of the fastest ways to cut through that noise and see exactly what your machines are saying to the outside world. This guide walks you through two forensic scenarios you can run today.

Setting Up a Targeted Capture

Wireshark captures every frame hitting your interface. On a busy network that’s overwhelming, so filter before you analyze. Launch a capture on your primary interface and apply a capture filter to isolate traffic immediately.

On Linux or macOS, use tshark — the command-line version of Wireshark — to capture directly to a file while filtering by host:

tshark -i eth0 -f "host 192.0.2.47" -w /tmp/workstation-jamie.pcap

This tells tshark to watch eth0, capture only packets to or from 192.0.2.47 (workstation belonging to user jamie), and write everything to a pcap file. Let it run for five to ten minutes during a suspected incident window, then stop and open the file in Wireshark’s GUI for deeper inspection.

Why save to a file first? Because live analysis causes you to miss context. With a pcap on disk you can replay, filter, and pivot without losing data. This is also what you hand to incident responders or legal teams.

Hunting Suspicious DNS Queries

DNS is the first thing attackers abuse — for C2 beaconing, data exfiltration, and domain generation algorithm (DGA) traffic. Open your pcap and apply this display filter in Wireshark:

dns and ip.src == 192.0.2.47

You’ll see every DNS query Jamie’s workstation sent. Here’s what a suspicious result looks like in tshark’s one-line output format:

tshark -r /tmp/workstation-jamie.pcap -Y "dns and ip.src == 192.0.2.47" \
  -T fields -e frame.time -e dns.qry.name

2026-09-22 09:14:03  updates.corp-internal.net
2026-09-22 09:14:11  a7f3k2.cdn-metrics[.]io
2026-09-22 09:14:11  b9d1q8.cdn-metrics[.]io
2026-09-22 09:14:12  c3m7p4.cdn-metrics[.]io
2026-09-22 09:14:13  e1x9r6.cdn-metrics[.]io

See the pattern? Legitimate traffic resolves recognizable hostnames. Those four queries to cdn-metrics[.]io with random-looking subdomains — each eight characters, each eight seconds apart — look exactly like DGA beaconing. An attacker’s implant is rotating through algorithmically generated subdomains trying to reach its C2 server.

Your next move: pivot to VirusTotal or PassiveDNS to check cdn-metrics[.]io‘s reputation, then block the domain at your DNS resolver and isolate Jamie’s machine. Pull the process list from the endpoint to find what’s generating the queries — most EDR tools let you correlate DNS calls back to a PID.

Reconstructing an HTTP Session

When a machine makes a suspicious HTTP connection, Wireshark lets you rebuild the entire conversation — headers, body, and all. Apply this filter to isolate HTTP traffic from the compromised host:

http and ip.addr == 192.0.2.47

Right-click any HTTP packet in the results, choose Follow > TCP Stream. Wireshark reconstructs the full request-response exchange. Here’s an example of what you might find:

GET /update?uid=jamie&h=CORP-WS-04&v=2.1 HTTP/1.1
Host: cdn-metrics[.]io
User-Agent: Mozilla/5.0 (compatible; updater/2.1)
Accept: */*

HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 4096

.MZ......PE..L...

That GET request is sending hostname and username as query parameters — classic implant check-in. The response returns what starts with MZ and PE — the magic bytes for a Windows executable. The C2 server just pushed a binary payload to Jamie’s machine over plain HTTP.

From here, export the response body using File > Export Objects > HTTP in Wireshark. Save the binary, hash it with sha256sum, and submit to VirusTotal. You now have the payload for malware analysis and a solid indicator of compromise to hunt across your environment.

What To Do Now

Pick one endpoint on your network — a workstation or server you own — and run a 10-minute tshark capture right now:

tshark -i eth0 -w /tmp/baseline-check.pcap
# after 10 minutes, Ctrl+C, then:
tshark -r /tmp/baseline-check.pcap -Y "dns" -T fields -e dns.qry.name \
  | sort | uniq -c | sort -rn | head -30

This one-liner shows your top 30 DNS queries by frequency. Anything with a high-entropy subdomain pattern, an unfamiliar apex domain, or regular timing intervals deserves a closer look. You’ll either confirm everything is clean or find something worth investigating — either outcome is useful intelligence.