Instant Traffic Analysis with Tshark How-to

Implementing useful filters (Should know)

This recipe will show new parameters and filters of Tshark through practical examples that will help us to resolve many security incidents efficiently. We'll see how to locate malicious domains in our network, how to create a passive DNS service, and how we can do specialized searches with certain display filters.

How to do it...

The method that follows shows how to implement useful filters using just Tshark.

Malicious domains

1. Knowing the pages to which users connect may be useful not only to meet web browsing patterns but also to locate infected computers. Here's an example:

   bmerino@Mordor:$ tshark -R http.request -T fields -e http.host -r malware.pcap  | sort -u > domains
   

2. This command will dump all domains ...