Free readiness test
Home / Tool labs / Wireshark / tshark

Wireshark / tshark hands-on lab Is WS-077 beaconing?

See exactly what's crossing the wire and spot malware calling home.

NetworkBeginnerFree live lab5 objectives
analyst@soc-ws:~/case-4471$
$ tshark -r capture.pcap -q -z conv,ip
================================================================================
IPv4 Conversations
                                   |  <-   |  |  ->   |  |  Total  |  Rel. Start | Duration
                                   | Frames  | Frames  | Frames  |             |
10.10.30.77  <-> 52.97.146.162     |  8,104  |  6,233  | 14,337  |    0.000    |  899.9   (Microsoft 365)
10.10.30.77  <-> 140.82.112.21     |  1,211  |    988  |  2,199  |   41.220    |  612.4   (GitHub)
10.10.30.77  <-> 185.243.115.84    |     60  |     60  |    120  |   12.004    |  840.0
10.10.30.77  <-> 10.10.0.53        |    106  |    106  |    212  |    0.112    |  899.1   (internal DNS)
================================================================================

What is Wireshark / tshark?

Wireshark is the standard packet analyser. tshark is its command-line twin with the same display filters, ideal for servers and for quickly slicing large captures.

1 Captures (pcap)

A pcap stores every packet seen on an interface: headers and payloads with precise timestamps.

2 Display filters

Filters like dns, http.request or ip.addr==1.2.3.4 narrow millions of packets to what matters.

3 Statistics

Conversations and protocol hierarchy show who talked to whom and how much before you read a single packet.

The scenario: Is WS-077 beaconing?

The EDR flagged workstation 10.10.30.77 for odd outbound traffic. The network team captured 15 minutes of its traffic into capture.pcap. Find out who it talks to, how, and whether it looks like command-and-control (C2) beaconing.

Live lab: try it now

Type the commands in the terminal below. Everything is simulated, so it's safe and legal and nothing is installed.

Step-by-step: Wireshark / tshark commands used in this lab

1Get an overview of protocols in the capture

Protocol hierarchy statistics.

tshark -r capture.pcap -q -z io,phs
Show sample output
===================================================================
Protocol Hierarchy Statistics
Filter:
eth                                      frames:18342 bytes:14120934
  ip                                     frames:18290 bytes:14101102
    tcp                                  frames:17402 bytes:13980411

2Find the top IP conversations

Conversation statistics for IP.

tshark -r capture.pcap -q -z conv,ip
Show sample output
================================================================================
IPv4 Conversations
                                   |  <-   |  |  ->   |  |  Total  |  Rel. Start | Duration
                                   | Frames  | Frames  | Frames  |             |
10.10.30.77  <-> 52.97.146.162     |  8,104  |  6,233  | 14,337  |    0.000    |  899.9   (Microsoft 365)
10.10.30.77  <-> 140.82.112.21     |  1,211  |    988  |  2,199  |   41.220    |  612.4   (GitHub)

3Review the DNS queries the host made

Display filter: dns

tshark -r capture.pcap -Y dns
Show sample output
   14  0.112  10.10.30.77 → 10.10.0.53  DNS  Standard query 0x1a2b A outlook.office365.com
   15  0.118  10.10.0.53 → 10.10.30.77  DNS  Standard query response A 52.97.146.162
  122 11.981  10.10.30.77 → 10.10.0.53  DNS  Standard query 0x5c11 A cdn-update-check.com
  123 12.002  10.10.0.53 → 10.10.30.77  DNS  Standard query response A 185.243.115.84
  402 41.201  10.10.30.77 → 10.10.0.53  DNS  Standard query 0x77e0 A github.com
... 106 queries total. cdn-update-check.com was registered 9 days ago and has no reputation.

4List the HTTP requests with host, URI and user agent

Filter http.request and print fields.

tshark -r capture.pcap -Y http.request -T fields -e frame.time_relative -e http.host -e http.request.uri -e http.user_agent
Show sample output
12.004   cdn-update-check.com   /api/v2/beacon?id=WS077-7f3a   Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
72.015   cdn-update-check.com   /api/v2/beacon?id=WS077-7f3a   Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
132.019  cdn-update-check.com   /api/v2/beacon?id=WS077-7f3a   Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
192.022  cdn-update-check.com   /api/v2/beacon?id=WS077-7f3a   Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
... 15 identical requests in total
Red flags: a fake 2001-era Internet Explorer user agent, a fixed victim ID, plain HTTP, and a path literally named "beacon".

5Measure the timing between requests to the suspicious IP

Filter on the IP and print frame.time_delta_displayed.

tshark -r capture.pcap -Y "ip.dst==185.243.115.84 && http.request" -T fields -e frame.time_delta_displayed
Show sample output
0.000000
60.011204
60.004118
60.003377
60.009902
59.998214

Key takeaways

Install Wireshark / tshark and practise for real

sudo apt install tshark wireshark   # Windows/macOS: wireshark.org

Practise with public sample captures from the Wireshark wiki and malware-traffic-analysis.net (in an isolated VM). Only scan or test systems you own or are explicitly authorised to assess. Official site: www.wireshark.org · Licence: GPLv2.

Scenario questions

Which domain is the C2 server?

Answer: cdn-update-check.com. A new domain, regular 60-second requests, a fake user agent and a 'beacon' path all point to cdn-update-check[.]com.

What makes traffic look like beaconing?

Answer: Regular intervals with small, similar requests. Malware checks in on a timer, so you see near-identical, small requests at fixed intervals.

What's the right first response?

Answer: Isolate WS-077 via EDR, block the domain/IP and start incident response. Contain first (isolate, block), preserve evidence, then investigate how it was infected.

More open-source tool labs

📡

Nmap

Discover hosts, open ports and services on networks you're authorised to assess.

🔭

Zeek

Turn raw traffic into rich, searchable logs for threat hunting.

🚨

Suricata

Detect attacks in network traffic with signatures, and write your own.

🛡️

Wazuh

An open-source SIEM and XDR: collect logs, detect attacks, respond automatically.

Σ

Sigma

Write a detection once, run it in any SIEM.

🧬

YARA

Describe malware by its patterns and hunt for it across files.