Unit 12: Capstone: investigate an incident · Lesson 1 of 5 · 20 min
Triage the capture
Get the shape of a 15 minute capture in five commands and pick the host to investigate.
mission
- You are
- The analyst on call for the incident.
- Situation
- At 13:20 the help desk reports that laptop-mchen is slow and odd files appeared. The network team saved the last 15 minutes of office traffic as
incident.pcap. - Goal
- Find out who in the capture behaves unlike the rest, without reading packets one by one.
- Hand in
- The suspect internal host and the outside address it talks to.
Size and time range
Write down the exact window first. Every statement in your report has to fit inside it.
capinfos -c -a -e incident.pcap
File name: incident.pcap
Number of packets: 850
First packet time: 2026-10-14 13:01:10.000000
Last packet time: 2026-10-14 13:16:20.001800
What kinds of traffic
The protocol hierarchy shows DNS, a little HTTP and a lot of TLS.
tshark -r incident.pcap -q -z io,phs
===================================================================
Protocol Hierarchy Statistics
Filter:
eth frames:850 bytes:748684
ip frames:850 bytes:748684
udp frames:32 bytes:3118
dns frames:32 bytes:3118
tcp frames:818 bytes:745566
http frames:2 bytes:595
media frames:1 bytes:386
tls frames:563 bytes:731309
tcp.segments frames:477 bytes:685113
tls frames:477 bytes:685113
===================================================================
you should see Two HTTP frames, one carrying a file (media), in an otherwise encrypted capture.
Who is busiest
Endpoints sorted by packets. One internal host stands far above the rest.
tshark -r incident.pcap -q -z endpoints,ip | sed -n '5,8p'
10.10.0.44 822 746024 653 682043 169 63981
203.0.113.99 785 743784 153 62949 632 680835
10.20.0.53 38 3442 19 2006 19 1436
10.10.0.23 14 1267 7 525 7 742
you should see 10.10.0.44 sent 682 kB, almost all of it to 203.0.113.99. It also touched four internal servers.
defender tip Pick one host and one question at a time. Triage is about choosing where to dig, not digging everywhere.
The afternoon on one rail
List every name looked up
DNS names give you the story before you read a single TCP stream.
tshark -r incident.pcap -Y 'dns.flags.response==0' -T fields -e dns.qry.name | sort | uniq -c
7 intranet.corp.example
1 invoice-portal.example.net
1 telemetry.invoice-portal.example.net
7 www.example.com
you should see Two names under invoice-portal.example.net stand out among normal intranet and web traffic.
What a defender takes away
- 1Window, protocols, endpoints: three commands give you the shape.
- 2The outlier in endpoints is usually your patient zero candidate.
- 3Write down the capture window before anything else.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.