Using Wireshark: Identifying Hosts and Users

guest · Mar 30, 2019

Using Wireshark: Identifying Hosts and Users
March 29, 2019
https://unit42.paloaltonetworks.com/using-wireshark-identifying-hosts-and-users/

When a host is infected or otherwise compromised, security professionals need to quickly review packet captures (pcaps) of suspicious network traffic to identify affected hosts and users.

This tutorial offers tips on how to gather that pcap data using Wireshark, the widely used network protocol analysis tool. It assumes you understand network traffic fundamentals and will use these pcaps of IPv4 traffic to cover retrieval of four types of data:
• Host information from DHCP traffic
• Host information from NetBIOS Name Service (NBNS) traffic
• Device models and operating systems from HTTP traffic
• Windows user account from Kerberos traffic
Click to expand...

Log in or Sign up

Using Wireshark: Identifying Hosts and Users

guest Guest

Log in or Sign up

Using Wireshark: Identifying Hosts and Users

guest Guest

Useful Searches