Purpose
Use this skill when packet-level evidence is needed to understand protocol behavior or defensive visibility.
Phase Fit
- Primary: Detection and Response Assessment
- Secondary: Discovery and Reconnaissance, Validation and Controlled Impact Demonstration
Use When
- Need to confirm protocol behavior, cleartext exposure, or unexpected service interactions.
- Need to compare observed traffic against what defenders can see and alert on.
- Need to troubleshoot whether a validation path is behaving as expected.
Avoid When
- Packet capture is not approved.
- The capture would collect unnecessary sensitive data or out-of-scope traffic.
Inputs
- Approved capture location and duration
- Relevant hosts, protocols, and time window
- Handling rules for sensitive capture data
Procedure
- Capture from the approved segment only.
- Filter quickly to the traffic that matches the current hypothesis.
- Identify cleartext data, protocol anomalies, or missing segmentation indicators.
- Compare packet observations to logs, alerts, and expected telemetry.
- Summarize only the evidence needed for reporting and control improvement.
Command Syntax
Replace sample interfaces and targets with approved in-scope values.
# Start Wireshark GUI on an interface
wireshark -i eth0 -k
# CLI capture (tshark) to file
tshark -i eth0 -w contoso-capture.pcap
# Capture filtered to a host and port
tshark -i eth0 -f "host 10.10.10.100 and tcp port 443" -w contoso-filtered.pcap
# Capture NTLM auth traffic
tshark -i eth0 -f "tcp port 445" -w contoso-smb.pcap
# Read a pcap and filter for HTTP POST
tshark -r contoso-capture.pcap -Y "http.request.method == POST"
# Extract HTTP host and URI fields
tshark -r contoso-capture.pcap -Y "http" -T fields -e http.host -e http.request.uri
# Capture LLMNR/NBT-NS traffic for poisoning evidence
tshark -i eth0 -f "udp port 5355 or udp port 137" -w contoso-llmnr.pcap
Evidence to Capture
- Protocol-level observations tied to the tested activity
- Cleartext or weakly protected flows that create material risk
- Logging blind spots or telemetry mismatches
Safety Boundaries
- Minimize capture scope and retention.
- Protect packet captures as sensitive evidence.