Network Security Packet Analysis

Packet analysis (also called packet capture or network forensics) involves capturing raw network traffic and examining each packet to understand exactly what is happening on a network. Security professionals use packet analysis to investigate incidents, detect attacks in progress, troubleshoot network problems, and verify that security controls work correctly.

What Is a Packet Capture

When a network interface is placed in "promiscuous mode," it captures every packet passing by — not just packets addressed to that interface. A packet capture file stores all these packets with full headers and payloads for later analysis. Wireshark is the most widely used tool for packet capture and analysis.

NORMAL MODE:
Network interface: "I only accept packets addressed to my MAC address.
                   I ignore everything else."

PROMISCUOUS MODE (packet capture):
Network interface: "I capture and record EVERY packet on this segment,
                   regardless of destination."

In a switched network, a SPAN/mirror port on the switch sends all traffic
to the capture interface, since modern switches don't broadcast to all ports.

Anatomy of a Captured Packet

Wireshark Packet View:
Frame 1847: 1434 bytes on wire
Arrival Time: 2024-03-15 09:14:22.331047

Ethernet II:
  Src: aa:bb:cc:dd:ee:ff (Attacker's MAC)
  Dst: 11:22:33:44:55:66 (Server's MAC)

Internet Protocol (IPv4):
  Src: 192.168.1.100
  Dst: 10.0.0.5
  TTL: 64
  Protocol: TCP

Transmission Control Protocol:
  Src Port: 54321
  Dst Port: 80
  Flags: SYN

Hypertext Transfer Protocol:
  GET /admin/login.php?user=admin'-- HTTP/1.1
  Host: 10.0.0.5
  User-Agent: sqlmap/1.7
  ↑ SQL injection tool detected in User-Agent!

Common Packet Analysis Scenarios

Detecting a Port Scan

Capture filter: host 192.168.1.100

Analysis shows rapid SYN packets to sequential ports:
Frame 1: 192.168.1.100 → 10.0.0.5:22  [SYN]
Frame 2: 192.168.1.100 → 10.0.0.5:23  [SYN]
Frame 3: 192.168.1.100 → 10.0.0.5:25  [SYN]
Frame 4: 192.168.1.100 → 10.0.0.5:53  [SYN]
Frame 5: 192.168.1.100 → 10.0.0.5:80  [SYN]
(1,000 ports scanned in 2 seconds)

Conclusion: Classic TCP SYN port scan in progress.
Response: Block 192.168.1.100 on firewall.

Detecting ARP Poisoning

Legitimate ARP:
Frame 1: Who has 192.168.1.1? Tell 192.168.1.50 (query)
Frame 2: 192.168.1.1 is at aa:bb:cc:11:22:33 (correct reply from router)

Suspicious ARP (poisoning):
Frame 1: 192.168.1.1 is at 00:de:ad:be:ef:00 (unsolicited announcement)
Frame 2: 192.168.1.1 is at 00:de:ad:be:ef:00 (repeated flooding)
Frame 3: 192.168.1.1 is at 00:de:ad:be:ef:00

Legitimate router never sent these. Unsolicited ARP replies changing
the gateway's MAC address → ARP poisoning in progress.

Analyzing Malware Command-and-Control Traffic

Suspicious DNS queries in capture:
Frame 4021: DNS query: a3b1c2d4e5.malware-c2.ru (base64-like subdomain)
Frame 4198: DNS query: xk9pmq7l8n.malware-c2.ru
Frame 5002: DNS query: tr8vfw2nys.malware-c2.ru

Pattern: Repeated DNS queries to same domain with encoded subdomains
→ DNS tunneling / malware C2 communication detected
→ Isolate infected host, block malware-c2.ru at DNS level

Wireshark Display Filters

Wireshark's display filter language lets analysts focus on specific traffic within a large capture file:

Common Wireshark Filters:

http.request.method == "POST"        → Show only HTTP POST requests
tcp.flags.syn == 1 && tcp.flags.ack == 0 → Show SYN packets (port scans)
ip.src == 192.168.1.100             → Traffic from specific IP only
dns.qry.name contains "malware"     → DNS queries containing "malware"
tcp.port == 443 && ssl.handshake    → TLS handshakes on HTTPS
http contains "UNION SELECT"        → SQL injection attempts in HTTP
frame.len > 1400                    → Large packets (possible exfiltration)
arp.opcode == 2 && !arp.isgratuitous → Suspicious ARP replies

Capturing Packets Legally and Ethically

Packet capture captures the data of every device on the network segment, including personal communications. This creates legal and privacy considerations:

Always Required Before Packet Capture:
✓ Written authorization from the network owner
✓ Scope defined (which segment, which timeframe)
✓ Legal review if in regulated industry (healthcare, finance)
✓ Compliance with local privacy laws (GDPR in EU, etc.)
✓ Data handling policy for captured traffic (who can access, retention period)
✓ Employee notification where required by local labor law

Packet capture on networks you do not own or have permission to capture
is illegal in most jurisdictions regardless of intent.

Network Traffic Baselines

Regular packet analysis builds a picture of normal traffic patterns — "baseline" behavior. When anomalies appear, they stand out against the baseline. A sudden spike in DNS queries, an unusual protocol appearing on the network, or traffic to an IP range that has never appeared before all become detectable when you know what normal looks like.

Packet analysis is one of the most powerful tools available to a security analyst. It provides ground truth — actual evidence of what happened on the wire — that no log summary, alert, or report can fully replace. The ability to read a packet capture and reconstruct an attack is a foundational skill for incident response and digital forensics work.