HTB Academy - Wireshark #2

Network Traffic Analysis — Worksheet (My Notes)

A tidy, fill-in-as-you-go checklist I use when reviewing packet captures. Copy it into your lab notes and complete each item as you analyze.

Fundamental Analysis

• How many conversations are there?
  Count unique 5-tuples (src/dst IP, src/dst port, protocol).

• Can we determine who the clients and servers are?
  Look at who initiates the TCP handshake (SYN) and who answers; check service ports.

• What protocols are being used?
  List by volume and importance (e.g., TCP/80, TCP/443, UDP/53, etc.).

• Anything notable happening?

  • Unusual or misused ports?
  • Clear-text credentials or sensitive data?
  • Protocol anomalies, resets, retransmits, errors?
  • Suspicious destinations, odd User-Agents, or beacons?

FTP Analysis

• Was FTP traffic present?
  Yes/No — Identify flows (typically TCP/21 for control, data on negotiated ports).

• Who was the FTP server?
  Record the server IP/hostname.

• Authentication context

  • Anonymous login used? Yes/No
  • Authenticated user? Username seen
  • Any credentials in clear text? Capture details carefully.

• Transferred content
  List filenames, directions (GET/PUT), sizes, and any noteworthy strings.

HTTP Analysis

• Web server identified?
  IP/host, server banner (e.g., Apache/Nginx/IIS), version if visible.

• What application is running?
  Framework/CMS/app hints from headers, paths, titles, fingerprints.

• Most common request methods
  e.g., GET, POST, HEAD, PUT, DELETE; include counts if helpful.

• Extras to check

  • Clear-text creds (Basic/Digest forms, params).
  • Interesting headers (Server, X-Powered-By, Cookies).
  • Notable endpoints (auth, admin, upload).
  • Response codes distribution (200/301/302/401/403/404/500).

Scope Snapshot

Use this table to summarize what you’ve actually observed.

Quick Tips

• Reconstruct conversations with flow filters; pivot from anomalies to context.
• When you see plaintext protocols (FTP/HTTP/Telnet), assume credentials and inspect carefully.
• Always note timestamps/timezone to align with other telemetry.