See Security Labs

SEC401 – Network Forensics

Lab 1.2 – Wireshark Packet Analysis

Solo, Lab

Focus: Network Forensics

Level: SEC401

Date: Mar 2026

Artifacts: Sanitized screenshots from Wireshark GUI analysis

TL;DR

  • Triaged 628K packets using protocol hierarchy and conversation statistics
  • Reconstructed a successful WordPress brute-force login via HTTP stream following
  • Completed live capture + HTTP object export on loopback traffic

Skills demonstrated

Wireshark protocol hierarchy analysisConversation and endpoint statisticsDisplay filter constructionTCP stream reconstructionHTTP object exportLive packet captureAttacker pattern recognition

Note: Course-provided PCAPs and lab instructions are not shared. Only my own captures and sanitized notes are published.

Why this matters

Wireshark turns raw packets into actionable intelligence. In incident response, the ability to quickly triage hundreds of thousands of packets using statistics, filters, and stream reconstruction is what separates a useful analyst from someone drowning in data. This lab builds exactly that muscle.

Context

This lab demonstrates how to use Wireshark's GUI-based packet analysis to investigate a 628K-packet PCAP, identify attack patterns through protocol hierarchy and conversation statistics, and reconstruct attacker sessions using display filters and stream following.

Tools used

WiresharkPCAP analysisDisplay filtersHTTP stream following

Steps taken

1Initial PCAP inspection

Opened investigate.pcap in Wireshark (628,631 packets). The first packets show a TCP three-way handshake between 135.125.217.54 and 10.130.8.94, followed by an HTTP GET /.env returning 404 Not Found. Same reconnaissance probe identified in Lab 1.1 with tcpdump.

2Protocol Hierarchy Statistics

Statistics → Protocol Hierarchy revealed the traffic composition: TCP dominated at 88.2% (554K packets), with HTTP at 22.6% and TLS at 44.3%. UDP accounted for 11.8%, with DNS at 1.1%. SMB2 (3.1%) and SSH (1.1%) also present. This gives an instant overview of what protocols to investigate.

3Conversation statistics: scanning pattern

Statistics → Conversations → TCP tab exposed a clear pattern: 3.142.238.241 made hundreds of short-lived connections to 10.130.8.94 on port 80, each with exactly 10 packets and ~1,375 bytes. This uniform, high-volume pattern is consistent with automated scanning or brute-force activity.

4Endpoint statistics

Statistics → Endpoints → TCP tab confirmed the top talkers: 1.1.1.1 (ports 80 and 443), 3.5.129.171 (port 443), and the mass of 3.142.238.241 ephemeral-port connections. This helps prioritize which hosts to investigate further.

5Display filter construction

Used Analyze → Display Filter Expression to build a filter for ip.addr == 20.106.124.93. The GUI filter builder shows available fields, operators, and validates the expression before applying. Helpful for constructing complex filters without memorizing syntax.

ip.addr == 20.106.124.93

6HTTP stream: WordPress brute-force success

Right-clicked → Follow → HTTP Stream on tcp.stream eq 13299. Revealed a POST to /wp-login.php from a Hydra user-agent with credentials in cleartext. The server responded 302 Found with WordPress authentication cookies and a redirect to /wp-admin/, confirming a successful brute-force login.

tcp.stream eq 13299

7Decoded form data inspection

Wireshark's protocol dissection decoded the URL-encoded form body: log=admin, pwd=#AlphaInc!, wp-submit=Log In, redirect_to=http://www.alphainc.ca/wp-admin/. Extracting structured fields from raw bytes is where Wireshark's GUI shines over command-line tools.

8Lab environment setup

Set up the lab environment: navigated to /sec401/labs/1.2, ran ./lab-1.2 start to launch the local web server, then opened Wireshark with sudo for live capture privileges.

cd /sec401/labs/1.2 && ./lab-1.2 start && sudo wireshark 2>/dev/null &

9Live capture: browsing the lab web app

Browsed to localhost:8080/welcome.html which displayed 'Welcome to SEC401!' with a 'Download Your File' link. This generated HTTP traffic on the loopback interface for live capture analysis.

10Live capture analysis with http filter

Applied the 'http' display filter on the live loopback capture. Wireshark showed GET /workbook/ and subsequent requests for CSS, JS, and image assets. Full page load dissected packet by packet. 250 packets captured, 42 displayed after filtering.

http

11HTTP object export: lab completion

Used File → Export Objects → HTTP to extract file.txt from the captured traffic. The file contained 'You completed the lab! Congratulations!' with ASCII art. This shows Wireshark can reconstruct and export files transferred over HTTP.

Key findings

628,631 packets: TCP 88.2%, HTTP 22.6%, TLS 44.3%, DNS 1.1%
3.142.238.241 → 10.130.8.94:80, hundreds of uniform 10-packet connections (port scanning/brute-force)
Successful WordPress login: POST /wp-login.php with Hydra user-agent, admin/#AlphaInc!, 302 → /wp-admin/
Live capture: HTTP object export recovered file.txt from loopback traffic

Outcome / Lessons learned

This lab built on the tcpdump foundation by showing how Wireshark's GUI accelerates investigation at scale. Protocol hierarchy gave an instant traffic breakdown. Conversation statistics surfaced the scanning pattern in seconds, something that would require careful scripting with tcpdump. Stream following reconstructed the full attacker session, confirming a successful WordPress brute-force with decoded credentials. The live capture exercise demonstrated end-to-end workflow: capture, filter, and extract artifacts.

If this were production: I'd correlate the 3.142.238.241 scanning pattern with firewall logs and threat intel feeds, check whether the brute-forced admin account was used for lateral movement, export IOCs (IPs, user-agents, target URLs) to the SIEM, and verify that wp-login.php is protected by rate limiting, MFA, and HTTPS.

Security controls relevant

  • Enforce HTTPS (HSTS) to prevent credential interception
  • MFA on WordPress admin accounts
  • Rate-limit and geo-block wp-login.php
  • WAF rules for automated tool user-agents (Hydra)
  • Network segmentation to limit lateral movement
  • Centralized logging + SIEM alerting on brute-force patterns

Evidence gallery