Browser LabFreeBeginner+50 XP

Analyze Your First PCAP

ScenarioA SOC analyst received a packet capture from a workstation that contacted a suspicious web server. Investigate the traffic and identify what happened.

Network Analysis

Analyze Your First PCAPFree

Best experienced on a larger screen.

No.	Time	Source	Destination	Protocol	Length	Info
1	0.000000	10.10.10.15	10.10.10.1	DNS	74	Standard query 0x1a2b A example.com
2	0.020411	10.10.10.1	10.10.10.15	DNS	90	Standard query response 0x1a2b A example.com A 93.184.216.34
3	0.045120	10.10.10.15	93.184.216.34	TCP	66	49780 → 80 [SYN] Seq=0 Win=64240
4	0.060233	93.184.216.34	10.10.10.15	TCP	66	80 → 49780 [SYN, ACK] Seq=0 Ack=1
5	0.061004	10.10.10.15	93.184.216.34	HTTP	431	GET / HTTP/1.1 (Host: example.com)
6	1.200884	10.10.10.15	10.10.10.1	DNS	78	Standard query 0x77c1 A update-sync.example
7	1.221530	10.10.10.1	10.10.10.15	DNS	94	Standard query response 0x77c1 A update-sync.example A 203.0.113.66
8	1.250004	10.10.10.15	203.0.113.66	TCP	66	49812 → 80 [SYN] Seq=0 Win=64240
9	1.265221	203.0.113.66	10.10.10.15	TCP	66	80 → 49812 [SYN, ACK] Seq=0 Ack=1
10	1.266010	10.10.10.15	203.0.113.66	TCP	60	49812 → 80 [ACK] Seq=1 Ack=1
11	1.280447	10.10.10.15	203.0.113.66	HTTP	218	GET /download/update.exe HTTP/1.1 (Host: update-sync.example)
12	1.520998	203.0.113.66	10.10.10.15	HTTP	512	HTTP/1.1 200 OK (application/octet-stream)

No.	Time	Source	Destination	Protocol	Length	Info
1	0.000000	10.10.10.15	10.10.10.1	DNS	74	Standard query 0x1a2b A example.com
2	0.020411	10.10.10.1	10.10.10.15	DNS	90	Standard query response 0x1a2b A example.com A 93.184.216.34
3	0.045120	10.10.10.15	93.184.216.34	TCP	66	49780 → 80 [SYN] Seq=0 Win=64240
4	0.060233	93.184.216.34	10.10.10.15	TCP	66	80 → 49780 [SYN, ACK] Seq=0 Ack=1
5	0.061004	10.10.10.15	93.184.216.34	HTTP	431	GET / HTTP/1.1 (Host: example.com)
6	1.200884	10.10.10.15	10.10.10.1	DNS	78	Standard query 0x77c1 A update-sync.example
7	1.221530	10.10.10.1	10.10.10.15	DNS	94	Standard query response 0x77c1 A update-sync.example A 203.0.113.66
8	1.250004	10.10.10.15	203.0.113.66	TCP	66	49812 → 80 [SYN] Seq=0 Win=64240
9	1.265221	203.0.113.66	10.10.10.15	TCP	66	80 → 49812 [SYN, ACK] Seq=0 Ack=1
10	1.266010	10.10.10.15	203.0.113.66	TCP	60	49812 → 80 [ACK] Seq=1 Ack=1
11	1.280447	10.10.10.15	203.0.113.66	HTTP	218	GET /download/update.exe HTTP/1.1 (Host: update-sync.example)
12	1.520998	203.0.113.66	10.10.10.15	HTTP	512	HTTP/1.1 200 OK (application/octet-stream)

Select a packet to see its details.

Tasks

Tasks solved: 0/3

Filter DNS traffic. Which suspicious domain did the workstation resolve?

Filter HTTP requests. Which URI did the workstation request from that server?

Follow the stream to the suspicious server. Which User-Agent made the request?