[Day 13] Packet Analysis Simply having a wonderful pcap time

Wireshark

To get an overview of the captured traffic you can navigate to “Statistics” -> “Protocol Hierachy”

As well “Statistics” -> “Conversations”. This helps to identify IPs and port used for conversations.

filter all pakets via “dns”. This shows the used domains

Filter by http traffic shows us that one downloaded two files

The files can be exported:

Lets take the sha265 checksum of the file.

Lets check the hash on virustotal