Wireshark statistics: hierarchy, conversations, I/O
You summarise a day of office traffic without reading it packet by packet: file properties, protocol hierarchy, conversations, endpoints and time intervals. With these tools you find the outside address with the most data exchanged, a computer "phoning home" at regular intervals and its interval, and write the summary report. The capture is different in every lab.
Level 101 · 50 min
You are in your second week at CORP’s security operations centre (SOC). Senior analyst Elif leaves you a capture file: "Yesterday’s traffic from a computer in accounting. Don’t read thousands of packets one by one; get the big picture first."
Wireshark’s Statistics menu is made for exactly this. Analogy: a company’s phone bill. Instead of listening to every call, you first look at who called whom, how often and for how long; the odd one stands out by itself.
The capture file is ~/captures/office-day.pcapng. Wireshark and the terminal are on the desktop, in the bottom panel. You will write your answers into small files in the terminal; the checks look at them. The first steps show the way, then the help fades.
What you will do in this lesson
- Open the capture
- Capture file properties
- Protocol hierarchy
- Conversations: most data with whom?
- Endpoints
- Regular intervals: beaconing
- The control server
- How much did the computer send?
- The summary report
- Short quiz
Skills you will earn
- Opening a capture file in Wireshark
- Reading a capture file’s properties (Capture File Properties, capinfos)
- Reading the protocol hierarchy
- Sorting conversations by bytes to find the standout
- Reading endpoints and bytes sent/received
- Finding beaconing by measuring the connection interval
- Writing a summary report from traffic statistics
← Filtering and watching DNS traffic with Wireshark · Wireshark fundamentals · Exporting from Wireshark →
Start for free