How do you analyze suspicious PCAP files in Wireshark to locate malicious C2 beaconing traffic?

Use Wireshark’s display filters, IO graphs, and protocol dissectors to isolate periodic DNS/HTTP/HTTPS requests that match known C2 patterns. **Step‑by‑step analysis** 1. **Capture with proper scope** – start Wireshark on the suspect host or span port, enable promiscuous mode, and capture at least 5 minutes of traffic to see repeated intervals. 2. **Apply baseline filters** – `!arp && !icmp && !nbns` removes noisy LAN chatter. 3. **Identify beacon candidates** – use the following display filters (copy‑paste into the filter bar): ```text dns && dns.flags.response == 0 && dns.qry.name matches "(?i)\\.exe$|\\.dll$" http.request && http.host matches "(?i)malicious|c2" tls && ssl.handshake.type == 1 && ssl.handshake.extensions_server_name matches "(?i)beacon" ``` 4. **Check timing regularity** – open *Statistics → IO Graph*, set the Y‑axis to “Packets” and the interval to 1 s. Look for spikes every 30‑120 s. 5. **Inspect payload** – right‑click a packet → *Follow → UDP/TCP Stream*; search for Base64 strings or XOR‑encoded commands. 6. **Correlate with threat intel** – export the IP list (`File → Export Packet Dissections → As CSV`) and run it through `maltrail` or `vt-py`: ```bash vt-py ip ``` 7. **Document findings** – note the beacon interval, protocol, and any encoded payload. Create a Snort/Suricata rule for future detection. **Quick protocol comparison** | Protocol | Typical beacon port | Encryption | Common filter | |----------|--------------------|------------|---------------| | DNS | 53 | None/DoH | `dns && …` | | HTTP | 80/8080 | Optional | `http.request && …` | | HTTPS | 443 | TLS | `tls && …` | **Gotcha:** Encrypted DNS (DoH/DoT) will hide the query name; you must decrypt the TLS stream (Wireshark 4.2+ with the server’s private key or a TLS‑key log file) before applying the DNS beacon filter.