wireshark mac address capture file find ip

We find that this IP has a low presence in the Wireshark statistics : 0.06% of the total sent packets (equal 52 packets) So, let’s filter the PCAP file using the IP adress used to send the first email : 140.247.62.34, both in the source and destination IP : ip.src=140.247.62.34 or ip.dst=140.247.62.34 (to learn the filtering by IP, check this : ) There is one key information to start analyzing the PCAP capture Now, read through the Powerpoint presentation to get an overview of the Case. As you can guess, we are going to use filters for our analysis…! No chance to read through each packet line by line…this is why a key concept in Wireshark is to make use of filters to narrow down any search made in the capture. This is quite long, and explains the quantity of packets received in this network capture : 94 410 lines. We also see that the elapsed time of the capture was about 4 hours and 22 minutes. We can see that the SHA1 and SHA256 hash signatures match with the ones given in the scenario (as expected).

It is usefull to check the source data in a “compact” format (instead of binary which would be very long)Īs a very first step, you can easily gather statistics about this capture, just using the statistics module of Wireshark : Statistics => Capture File Properties In the third section, we have the details of the packet number 1 in HEX format. For packet number 1, we have informations about the first four layers (respectively n☁ “wire”, n☂ “Ethernet”, n☃ “IP”, n☄ “TCP”) In the second section, you see the details of a packet (here packet/frame number 1), shown according to the main layers of the OSI model. In the first section, you get the list of packets/frames ordered by number, time, source IP, destination IP, protocol, length, and informations about content You get a first overview of the very long list of packets captured Just click on the PCAP file, and it should open in Wireshark. The first one is the presentation of the Case :

This scenario includes two important documents All the material is available here, published under the CC0 licence : I’m going to follow step by step a network forensics case, the Nitroba State University Harrassment Case. You can easily download and install Wireshark here, on a Windows 10 machine for example, and NetworkMiner here

In this article, I’m going to show you how to use Wireshark, the famous network packet sniffer, together with NetworkMiner, another very good tool, to perform some network forensics.

Wireshark mac address capture file find ip