Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Wireshark Tutorial: Changing Your Column Display

Summary: Unit 42 published a Wireshark tutorial, first released in August 2018 and updated for 2023, that walks through customizing the column display to better review malicious network traffic. The tutorial uses Wireshark version 4.0.7 on Xubuntu, recommends version 3.6.2 or later, and covers changing the time format to UTC, removing the No., Protocol and Length columns, adding Src port and Dst port columns, and combining HTTP Host and TLS server_name fields into a single column.

What's compelling: The tutorial notes that pcaps from Windows infections may contain malicious binaries that present an infection risk when Wireshark is run on a Windows computer, which is why it recommends a BSD, Linux or macOS environment. For an investigator pulling traffic from a suspected infection, the default column layout does not surface the web domains that malware distribution, exfiltration and command-and-control activity rely on.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related