Network Traffic Analysis ¶

Network Traffic Analysis may involve capture traffic and investigating it to find useful information such as:

• 📚 Interesting files to reverse
• 🗝️ Cleartext passwords
• 🗺️ Lists of hosts/IP and protocols
• ...

We may not have a GUI and have to use a TUI or CLI applications.

You may use tshark -r xxx.pcap -w yyy.pcap -F libpcap to convert a libpcap file to a standard file if Python tools complain.

Common applications are:

• Wireshark (GUI)
• termshark (TUI)
• tshark (CLI)
• tcpdump (CLI)
• netminer (paid 💵)
• pktmon (CLI)

net-creds — Simple Packet Analyzer ¶

net-creds (1.6k ⭐, 2019 🪦) is a network packet sniffer which superseded creds.py (0.2k ⭐, 2015 🪦). It's written in Python2.

$ wget "https://raw.githubusercontent.com/DanMcInerney/net-creds/master/net-creds.py"
$ wget "https://raw.githubusercontent.com//quentinra/blog.quentinra.dev/cybersecurity/red-team/_knowledge/topics/_files/py3_and_fixes.patch"
$ patch -u < py3_and_fixes.patch
$ python3 net-creds.py -p xxx.pcap

NetworkMiner — Paid Packet Analyzer ¶

NetworkMiner is a paid packet analyzer for Windows. It groups network traffic in tabs and per host. There is a free version 💸.

apackets — Online Packet Analyzer ¶

Refer to apackets. All free analysis are public.

tcpflow — Dump TCP Flows ¶

You can use tcpflow (1.6k ⭐), which is similar to wireshark 'Follow TCP Streams' feature, to dump TCP Streams.

$ tcpflow -r xxx.pcap -C0

• Port scanning: look for packets matching the scan (ex: SYN=1;ACK=0)
• tshark -Y, tshark -r xxx.pcapng -T fields -e data.txt