Exporting from Wireshark
You extract a suspicious program a user downloaded from the traffic as evidence, take its digest (SHA-256) and verify its type; you find where it came from and who downloaded it, export the related packets to a separate file and the requests to a table, and prepare an IOC list. The downloaded file differs in every lab.
Level 101 · 50 min
The antivirus raised an alert on a workstation, but deleted the file. Elif asks: "The file is still in the traffic. Extract it, take its digest, find where it came from. We need indicators (IOCs) to search the other computers too."
Wireshark isn’t just for looking; you can export what you see: files carried over HTTP (Export Objects), part of the packets into a new capture file (Export Specified Packets) and packet details into a table (Export Packet Dissections). The figure shows these three ways.
The capture: ~/captures/incident-download.pcapng. You will collect your evidence in the ~/evidence folder. Careful: never run the program you extract; only take its digest and inspect it.
What you will do in this lesson
- Open the capture
- Extract the file: Export Objects
- Fingerprint: SHA-256
- What is the file really?
- Where did it come from?
- Who downloaded it?
- Only the related packets: Export Specified Packets
- The request table
- The IOC list
- Short quiz
Skills you will earn
- Exporting files carried over HTTP (Export Objects)
- Taking an evidence file’s SHA-256 digest
- Verifying a file’s real type from its magic bytes
- Extracting indicators (IOCs) from traffic
- Exporting only the related packets to a new file (Export Specified Packets)
- Exporting packet details as a CSV table
← Wireshark statistics: hierarchy, conversations, I/O · Wireshark fundamentals · IPv6 and ICMPv6 traffic with Wireshark →
Start for free