Network Incident Investigation: Comparing Capture Approaches
When an unexpected alert fires on an internal server or network monitoring flags an outbound spike, finding root cause demands packet-level visibility. Depending on server resources and incident scope, security teams typically rely on three investigation workflows:
| Approach | Primary Use Case | Resource Impact | Payload Visibility |
|---|---|---|---|
| GUI Deep Packet Inspection (Wireshark) | Post-incident forensic triage, protocol reconstruction, and signature verification. | High memory on large files; best used on analyst workstations. | Full layer 2 to layer 7 payload inspection. |
| CLI Packet Sniffers (tcpdump / tshark) | Live headless capture on production nodes, scriptable packet filtering, low-overhead recording. | Minimal memory footprint, CPU bound at 10+ Gbps throughput. | Full payload available, formatted via terminal output or raw PCAP. |
| Flow Records (NetFlow / IPFIX / sFlow) | Long-term traffic baselining, volumetric anomaly detection, bandwidth auditing. | Very low storage overhead with sampled collection (e.g., 1:1000 packets). | Metadata only (IPs, ports, packet counts, timestamps; no payload). |
Flow summaries show that an internal host pushed 2.4 GB of data to an unknown external IP at 3:15 AM. Wireshark shows you what was inside those packets: plain-text database dumps, command-and-control beacons, or SQL injection strings hitting an exposed service.
Pros and Cons of Deep Packet Inspection with Wireshark
Pros
- Exhaustive Protocol Dissection: Wireshark decodes over 3,000 protocols out of the box, dissecting nested headers across TCP, TLS handshakes, DNS records, and proprietary protocols.
- Conversational Reassembly: You can reconstruct an entire TCP stream with a single click to read cleartext payloads, HTTP transactions, or raw binary payloads.
- Granular Display Filter Syntax: Advanced boolean expressions let you pinpoint microsecond timing anomalies, sudden TCP window collapses, or suspicious TCP flag combinations.
Cons
- Heavy Memory Footprint: Loading raw PCAP captures larger than 1–2 GB directly into Wireshark can exhaust RAM and lock up the desktop interface.
- Encryption Blindspots: With TLS 1.3 protecting modern web traffic, payload inspection requires pre-master session secrets (via
SSLKEYLOGFILE) or upstream SSL termination logs. - Production Risk: Never run a desktop GUI packet analyzer directly on production servers. Doing so expands your attack surface and wastes critical server resources.
Recommended Architecture for Safe Traffic Analysis
Keep your capture layer strictly separated from your analysis environment. Sniff packets on target servers using lightweight CLI tools, then pull the capture files to an isolated workstation for inspection in Wireshark.
To record traffic on Linux without giving engineers full root shells, configure tcpdump with dedicated Linux capabilities:
# Create a dedicated packet capture user group
sudo groupadd pcap
sudo usermod -a -G pcap $USER
# Assign capture capabilities to tcpdump binary
sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump
Jump hosts and forensic capture servers need strong, distinct passwords from day one. I use the password generator at toolcraft.app/en/tools/security/password-generator to generate 32-character server credentials—it executes entirely client-side in the browser without sending data over the network. Once your capture nodes are locked down, pull the PCAP files locally for triage.
Step-by-Step Implementation Guide
1. Capture Traffic Headless with tcpdump
Unconstrained packet captures can exhaust server disk space within minutes. Instead, configure a ring buffer that limits individual file sizes and rotates automatically:
# Capture on eth0, write 5 rolling files of 100MB each
tcpdump -i eth0 -nn -s 0 -W 5 -C 100 -w /var/log/incident_capture.pcap
Let the capture run through your incident window, stop the process with Ctrl+C, and transfer incident_capture.pcap to your local analysis station.
2. Apply Essential Display Filters
Display filters run against capture data already in memory. Paste these syntax rules directly into the Wireshark filter bar to isolate common indicators of compromise:
- Isolate a suspect IP and ignore standard service ports:
ip.addr == 192.168.1.50 && !(tcp.port in {80, 443, 22, 53}) - Locate cleartext credential submissions:
http.request.method == "POST" || ftp.request.command in {"USER", "PASS"} - Catch NXDOMAIN errors (frequent during malware DGA domain cycling):
dns.flags.rcode == 3
3. Detect Network Reconnaissance and Port Scans
Attackers scan targets before attempting exploits. Each scanning technique leaves unmistakable artifacts in packet headers.
Detecting TCP SYN Stealth Scans
A stealth SYN scan (such as nmap -sS -T4) sends TCP packets with only the SYN flag set. The scanner never completes the three-way handshake, discarding incoming SYN-ACKs with RSTs. To isolate these half-open connection attempts:
tcp.flags.syn == 1 && tcp.flags.ack == 0 && tcp.window_size <= 1024Check the Packet List pane. When a single IP addresses thousands of sequential destination ports in just a few seconds, you have caught an active port scan.
Detecting NULL, FIN, and XMAS Scans
Attackers occasionally use non-standard TCP flag combinations to bypass legacy stateless firewalls:
- NULL Scan (No flags set):
tcp.flags == 0x000 - FIN Scan (Only FIN flag set):
tcp.flags == 0x001 - XMAS Scan (FIN, PSH, and URG flags set):
tcp.flags == 0x029
RFC 793 compliant stacks reject these malformed packets. Legitimate applications do not generate them, so any match warrants immediate investigation.
4. Reconstruct Sessions and Extract Binaries
When you spot a suspicious connection—such as an interactive shell or unauthorized API request—you can reassemble the full stream:
- Right-click the suspicious packet in the packet list.
- Select Follow > TCP Stream.
- Inspect the ASCII dialog: client commands appear in red, server responses in blue.
If an attacker pulled a second-stage payload or web shell over unencrypted HTTP, export the file directly through Wireshark:
- Click File > Export Objects > HTTP…
- Find the target payload in the object listing.
- Click Save to export the binary into an isolated VM or sandbox folder for static analysis.
5. Spot Data Exfiltration via DNS Tunneling
DNS tunneling gives attackers a covert egress channel when all other outbound ports are blocked. Malware encodes exfiltrated files or C2 instructions into subdomain strings (such as a8f3b2.c2server.com) directed at an attacker-controlled nameserver.
Run this filter to catch long query names sent to external resolvers:
dns.flags.response == 0 && dns.qry.name.len > 35Inspect the query strings. High-entropy, Base64-like subdomains appearing in bursts of 50+ requests per minute to one root domain indicate active data exfiltration.
