Lab 1.2 – Wireshark Packet Analysis

Network Forensics | SEC401 | Mar 2026

Investigated a 628K-packet PCAP in Wireshark: used protocol hierarchy and conversation statistics to surface a port-80 scanning pattern from 3.142.238.241, followed an HTTP stream revealing a successful WordPress brute-force login (Hydra, admin/#AlphaInc!), and completed a live-capture exercise extracting an HTTP object from loopback traffic.

Tools: Wireshark, PCAP analysis, Display filters, HTTP stream following

Commands

1. Initial PCAP inspection

Opened investigate.pcap in Wireshark (628,631 packets). The first packets show a TCP three-way handshake between 135.125.217.54 and 10.130.8.94, followed by an HTTP GET /.env returning 404 Not Found. Same reconnaissance probe identified in Lab 1.1 with tcpdump.

2. Protocol Hierarchy Statistics

Statistics → Protocol Hierarchy revealed the traffic composition: TCP dominated at 88.2% (554K packets), with HTTP at 22.6% and TLS at 44.3%. UDP accounted for 11.8%, with DNS at 1.1%. SMB2 (3.1%) and SSH (1.1%) also present. This gives an instant overview of what protocols to investigate.

3. Conversation statistics: scanning pattern

Statistics → Conversations → TCP tab exposed a clear pattern: 3.142.238.241 made hundreds of short-lived connections to 10.130.8.94 on port 80, each with exactly 10 packets and ~1,375 bytes. This uniform, high-volume pattern is consistent with automated scanning or brute-force activity.

4. Endpoint statistics

Statistics → Endpoints → TCP tab confirmed the top talkers: 1.1.1.1 (ports 80 and 443), 3.5.129.171 (port 443), and the mass of 3.142.238.241 ephemeral-port connections. This helps prioritize which hosts to investigate further.

5. Display filter construction

Used Analyze → Display Filter Expression to build a filter for ip.addr == 20.106.124.93. The GUI filter builder shows available fields, operators, and validates the expression before applying. Helpful for constructing complex filters without memorizing syntax.

ip.addr == 20.106.124.93

ip.addr: match source or destination IP ==: exact match operator

6. HTTP stream: WordPress brute-force success

Right-clicked → Follow → HTTP Stream on tcp.stream eq 13299. Revealed a POST to /wp-login.php from a Hydra user-agent with credentials in cleartext. The server responded 302 Found with WordPress authentication cookies and a redirect to /wp-admin/, confirming a successful brute-force login.

tcp.stream eq 13299

tcp.stream: isolate a single TCP conversation eq 13299: stream index from Wireshark's reassembly

7. Decoded form data inspection

Wireshark's protocol dissection decoded the URL-encoded form body: log=admin, pwd=#AlphaInc!, wp-submit=Log In, redirect_to=http://www.alphainc.ca/wp-admin/. Extracting structured fields from raw bytes is where Wireshark's GUI shines over command-line tools.

8. Lab environment setup

Set up the lab environment: navigated to /sec401/labs/1.2, ran ./lab-1.2 start to launch the local web server, then opened Wireshark with sudo for live capture privileges.

cd /sec401/labs/1.2 && ./lab-1.2 start && sudo wireshark 2>/dev/null &

./lab-1.2 start: launch local web server sudo wireshark: root privileges for capture 2>/dev/null &: suppress warnings, run in background

9. Live capture: browsing the lab web app

Browsed to localhost:8080/welcome.html which displayed 'Welcome to SEC401!' with a 'Download Your File' link. This generated HTTP traffic on the loopback interface for live capture analysis.

10. Live capture analysis with http filter

Applied the 'http' display filter on the live loopback capture. Wireshark showed GET /workbook/ and subsequent requests for CSS, JS, and image assets. Full page load dissected packet by packet. 250 packets captured, 42 displayed after filtering.

http

http: display filter showing only HTTP protocol packets Filters out TCP handshakes, TLS, DNS, etc.

11. HTTP object export: lab completion

Used File → Export Objects → HTTP to extract file.txt from the captured traffic. The file contained 'You completed the lab! Congratulations!' with ASCII art. This shows Wireshark can reconstruct and export files transferred over HTTP.

Key Findings

628,631 packets: TCP 88.2%, HTTP 22.6%, TLS 44.3%, DNS 1.1%
3.142.238.241 → 10.130.8.94:80, hundreds of uniform 10-packet connections (port scanning/brute-force)
Successful WordPress login: POST /wp-login.php with Hydra user-agent, admin/#AlphaInc!, 302 → /wp-admin/
Live capture: HTTP object export recovered file.txt from loopback traffic

Security Controls

Enforce HTTPS (HSTS) to prevent credential interception
MFA on WordPress admin accounts
Rate-limit and geo-block wp-login.php
WAF rules for automated tool user-agents (Hydra)
Network segmentation to limit lateral movement
Centralized logging + SIEM alerting on brute-force patterns