Lisa Bock reviews using the Statistics menu option when doing malware analysis, including conversations, which is traffic between two endpoints, and viewing the protocol hierarchy to analyze unusual or suspicious protocols on the network.
- [Narrator] When doing Malware analysis…it's good practice to explore…Wireshark Statistics menu choice.…We can see that there are many options…for analyzing a packet capture.…When looking at the statistics choices,…we see that there are general statistics…that include capture file properties,…protocol hierarchy, conversations, endpoints,…and IO graphs.…In addition, there are protocol specific…and advanced statistics.…
Those include service response times,…DNS and HTTP, IP version four, and IP version six,…flow graphs, and TCP stream graphs.…When doing Malware analysis, I take a look…at a couple of the choices including endpoints.…Now this is traffic to and from a single IP address.…Conversations, this is traffic between two endpoints,…and protocol hierarchy, this helps us to analyze…unusual or suspicious protocols on the network.…
I'm at this packet capture,…and here I have gotten this capture from a client…who says there simply was a lot of traffic…for a small home network.…Now let's take a look at the statistics.…
- Trends in cyberattacks
- Preventing system compromise
- Analyzing packets
- Using Wireshark
- Creating firewall rules
- Baselining a network
- Using capture filters
- Using a ring buffer
- Handling OSI layer attacks
- Identifying attack signatures
- Using VirusTotal
- Handling unwanted TOR activity
Skill Level Intermediate
Troubleshooting Your Network with Wiresharkwith Lisa Bock2h 35m Intermediate
Learning Computer Forensics (2014)with Jungwoo Ryoo1h 57m Intermediate
Insights from a Cybersecurity Professionalwith Mike Chapple32m 15s Intermediate
1. Deep Packet Analysis
2. Capture Overview
3. Unusual Traffic
4. Case Studies
Next steps1m 30s
- Mark as unwatched
- Mark all as unwatched
Are you sure you want to mark all the videos in this course as unwatched?
This will not affect your course history, your reports, or your certificates of completion for this course.Cancel
Take notes with your new membership!
Type in the entry box, then click Enter to save your note.
1:30Press on any video thumbnail to jump immediately to the timecode shown.
Notes are saved with you account but can also be exported as plain text, MS Word, PDF, Google Doc, or Evernote.