Then, you open a 2GB network capture in Wireshark, excited to be one of the “leet” few who use this powerful tool and you get this…
One of the more powerful techniques for network hunting is sifting through a network capture. In this post, we will be looking at how to identify the connections with the most packets, how to enable DNS resolution in the captures, and how to create a series of basic filters to remove known “good” traffic from the packet capture. Specifically, we want to have a packet capture of the traffic from that system that is leaving your network going out to the Internet. And, let’s say you can get a packet capture from that system.
Let’s say you have a system you believe to be compromised.
0 kommentar(er)
