CyberSec Lab — Wireshark Packet Analysis

OBJECTIVES

Apply a display filter

Find FTP credentials in plaintext

Find HTTP Basic Auth credentials

Follow a Telnet stream

Identify the DNS exfiltration attempt

Detect the port scan in traffic

View protocol statistics

Submit the analysis report

🦈

Wireshark

📊

Statistics

📖

Reference

📝

Notepad

📋

Report

NETWORK SECURITY — TRAFFIC ANALYSIS

WIRESHARK — PACKET ANALYSIS

PCAP: apexlab_incident.pcap — 847 packets

SCENARIO

The network team captured traffic on the APEXLAB internal segment during a 15-minute window flagged by the IDS. Analyse apexlab_incident.pcap to identify cleartext credentials, suspicious protocols, and anomalous traffic patterns.

NETWORK SEGMENT

Host	IP
Workstation	10.10.14.22
FTP server	10.10.14.50
Web server	10.10.14.100
Telnet device	10.10.14.200
DNS server	10.10.14.1
External	185.220.101.45

HOW TO USE

Type display filters in the filter bar and click Apply
Click any packet to inspect its fields in the detail pane
Right-click any packet and select Follow TCP Stream to view the full conversation
Use Statistics for protocol breakdown

USEFUL FILTERS

Filter	Shows
ftp	FTP traffic
http	HTTP traffic
telnet	Telnet sessions
dns	DNS queries
tcp.flags.syn==1	SYN packets (scans)
ftp contains "PASS"	FTP passwords
http contains "Authorization"	HTTP auth

REFERENCE — WIRESHARK

DISPLAY FILTER SYNTAX

ftp http dns telnet tcp udp icmp

ip.src == 10.10.14.22 ip.addr == 10.10.14.50 tcp.port == 21 ftp contains "PASS" http contains "Authorization" tcp.flags.syn == 1 and tcp.flags.ack == 0

PLAINTEXT PROTOCOLS

FTP (port 21) — USER and PASS sent as cleartext commands

HTTP Basic Auth — credentials Base64 encoded in the Authorization header. Decode to recover user:password

Telnet (port 23) — entire session including passwords is plaintext. Follow TCP Stream to see all keystrokes

DNS — queries can encode exfiltrated data in subdomain labels

PORT SCAN DETECTION

Nmap SYN scan: many TCP SYN packets from one IP to sequential ports on the same destination with no prior connection. Filter: tcp.flags.syn==1 and look for the pattern.

DNS EXFILTRATION

Attackers encode data in DNS query names — e.g. aGVsbG8=.evil.com where the subdomain is Base64 data. Look for long subdomains, many NXDOMAIN responses, or high query volume to an external domain.