Skip to content
Live · 4 exercises

Network Forensics Lab

Four downloadable PCAP files, each built to exercise one real detection pattern: C2 beaconing, DNS tunneling, internal lateral movement, and a clean baseline for comparison. Open each one in Wireshark (or run the tshark commands provided) and work through the questions before revealing the analysis.

These captures are constructed for this lab, not pulled from a real incident or third-party source — every packet uses real, valid protocol structure, so they open and filter correctly in Wireshark, tshark, or Arkime, but the traffic itself is synthetic. That’s deliberate: it means the exercises are self-contained and don’t depend on redistributing anyone else’s captured traffic.

1. HTTP(S) C2 Beaconing

Intermediate

A workstation (10.0.5.23) has connections to an external host on port 443 scattered through this capture. Determine whether this is ordinary HTTPS browsing or something else, and explain what convinced you either way.

Download 01-c2-beaconing.pcap (8 KB)

Work through

  • 1.How many distinct connections does 10.0.5.23 make to the external host, and what's the time delta between each one?
  • 2.Is there a DNS query resolving the external IP anywhere in this capture? What does its absence (or presence) tell you?
  • 3.Compare the size of the outbound request payload across each connection. What do you notice?

Useful filters

Isolate the suspicious host pair

ip.addr == 203.0.113.77

Check for a preceding DNS lookup

dns.qry.name and ip.addr == 203.0.113.77

tshark: list every connection's start time

tshark -r 01-c2-beaconing.pcap -Y "tcp.flags.syn==1 && tcp.flags.ack==0 && ip.dst==203.0.113.77" -T fields -e frame.time_relative

2. DNS Tunneling / Exfiltration

Intermediate

This capture is almost entirely DNS traffic. Most of it goes to one domain. Work out whether this is normal DNS resolution traffic or something is being smuggled out over DNS, and how you'd tell the difference at a glance in a much larger capture.

Download 02-dns-tunneling.pcap (20 KB)

Work through

  • 1.Which domain receives the overwhelming majority of queries, and what record type is being requested?
  • 2.Look at the subdomain labels in those queries. What's unusual about their length and character set compared to the handful of ordinary lookups also present in this capture?
  • 3.What's the query rate to that domain, and how would a normal recursive resolver's caching behaviour differ from what you see here?

Useful filters

Isolate queries to the suspicious domain

dns.qry.name contains "datasync-cdn.net"

Filter to TXT record queries specifically

dns and dns.qry.type == 16

tshark: count queries per unique first label length

tshark -r 02-dns-tunneling.pcap -Y "dns.flags.response==0" -T fields -e dns.qry.name | awk -F. '{print length($1)}' | sort -n | uniq -c

3. Internal Lateral Movement (SMB Sweep)

Advanced

The same workstation from Exercise 1 shows up again here, this time talking to a lot of other internal hosts. Determine what it's doing and whether the pattern is consistent with normal file-share usage or with post-compromise reconnaissance.

Download 03-lateral-movement-smb-sweep.pcap (6 KB)

Work through

  • 1.How many distinct internal destination IPs does 10.0.5.23 contact, and on what port?
  • 2.What's the total time window across all of these connection attempts?
  • 3.What fraction of the attempts get a SYN-ACK versus a RST? What does that ratio suggest about how the source is behaving?

Useful filters

Isolate SMB connection attempts from the host

ip.src == 10.0.5.23 and tcp.port == 445 and tcp.flags.syn == 1

See which targets actually accepted the connection

tcp.flags.syn == 1 and tcp.flags.ack == 1 and tcp.srcport == 445

tshark: unique destination count and time span

tshark -r 03-lateral-movement-smb-sweep.pcap -Y "ip.src==10.0.5.23 && tcp.dstport==445 && tcp.flags.syn==1" -T fields -e ip.dst -e frame.time_relative

4. Baseline: What Normal Looks Like

Beginner

Not every capture has something wrong in it. This one is ordinary browsing traffic — use it to calibrate what "normal" looks like against the previous three exercises, so you don't start pattern-matching noise as malicious in real investigations.

Download 04-baseline-clean.pcap (2 KB)

Work through

  • 1.How many distinct destinations does this host contact, and how are the connection intervals distributed compared to Exercise 1's beacon?
  • 2.Does every TCP connection have a DNS lookup immediately before it?
  • 3.What would make you suspicious in a capture like this one, if anything did?

Useful filters

List every destination contacted

ip.src == 10.0.5.23 and tcp.flags.syn == 1 and tcp.flags.ack == 0

Confirm DNS-before-connect ordering

dns or (tcp.flags.syn==1 and tcp.flags.ack==0)
← Back to Labs