Global edit history

How do you analyze suspicious PCAP files in Wireshark to locate malicious C2 beaconing traffic?

Network Exploitation & Wireshark · 2 saved versions

Back to thread

Version 1 (Edit)

Edited by Rajesh Sharma · Aug 23, 2026 6:22 PM

0 edit points 0 upvotes
Change note

Content depth regeneration via community:regenerate-content

Title snapshot

How do you analyze suspicious PCAP files in Wireshark to locate malicious C2 beaconing traffic?

Summary snapshot
Filtering by display filters, analyzing TCP stream follow, jitter intervals, and TLS SNI requests.
Content snapshot
### Wireshark Analysis Steps 1. **Filter Traffic**: Use `http.request or tls.handshake.type == 1` display filters to review domain connections. 2. **Analyze Beaconing Jitter**: Sort packet timestamps to locate repetitive automated outbound connections occurring at fixed intervals (e.g. every 60 seconds). 3. **Follow Stream**: Inspect raw TCP payload streams for suspicious base64 encoded strings or non-standard protocol commands.
Source snapshot

https://www.wireshark.org/docs/wsug_html_chunked/

Version 1 (Original Post)

Published by Rajesh Sharma · Aug 9, 2026 5:37 AM

Original Publication
Events Log

Post originally created and published to the Global Hub.

Original Title

How do you analyze suspicious PCAP files in Wireshark to locate malicious C2 beaconing traffic?

Original Summary
Filtering by display filters, analyzing TCP stream follow, jitter intervals, and TLS SNI requests.
Original Content
### Wireshark Analysis Steps 1. **Filter Traffic**: Use `http.request or tls.handshake.type == 1` display filters to review domain connections. 2. **Analyze Beaconing Jitter**: Sort packet timestamps to locate repetitive automated outbound connections occurring at fixed intervals (e.g. every 60 seconds). 3. **Follow Stream**: Inspect raw TCP payload streams for suspicious base64 encoded strings or non-standard protocol commands.
Original Sources

https://www.wireshark.org/docs/wsug_html_chunked/