Network

Wireshark

Packet capture and protocol analysis for authorized network and wireless assessments.

Open sourceReconScanningInternalExternal

What it is

Wireshark (and tshark/dumpcap) is how you prove what the wire actually does: cleartext protocols, LLMNR/NBT-NS, SMB signing, and mis-set TLS. Capture on a span or the assessment laptop, keep pcaps in the engagement vault, and redact before they leave.

Reach for it when

Internal assessments, protocol reviews, and anytime you need evidence of cleartext or name-resolution hygiene.

Watch-outs

Captures on user VLANs will contain credentials and, in healthcare, ePHI. Filter in capture, store encrypted, and do not copy pcaps to personal machines. Never capture on OT spans without a dedicated RoE line.

Typical invocation

tshark -i eth0 -f 'port 53 or port 5355 or port 445' -w evidence/vlan16.pcapng

Authorized assessments only. Stay inside the rules of engagement.

Pin to a kit

Open an engagement first.

Nmap
Network mapper for host discovery, port scans, and service/version detection on in-scope ranges.
Responder
LLMNR/NBT-NS/mDNS analysis and poisoning for authorized internal identity assessments.
NetExec
Network execution and enumeration suite for SMB, LDAP, WinRM, and related Windows services.