Analyze network traffic using Wireshark's custom columns, filters, and statistics to identify suspicious web server administration access and potential compromise.

The SOC team has identified suspicious activity on a web server within the company's intranet. To better understand the situation, they have captured network traffic for analysis. The PCAP file may contain evidence of malicious activities that led to the compromise of the Apache Tomcat web server. Your task is to analyze the PCAP file to understand the scope of the attack.

Wireshark network filter guides

Q1. Identify the Attacker's Source IP

Question

Given the suspicious activity detected on the web server, the PCAP file reveals a series of requests across various ports, indicating potential scanning behavior. Can you identify the source IP address responsible for initiating these requests on our server?

Methodology

The first objective is to identify which host is performing reconnaissance against the server.

Steps

1. Open the PCAP in Wireshark.
2. Navigate to:

Statistics → Conversations

1. Select the TCP tab.
2. Review the list of conversations.
3. Look for an IP communicating with many different destination ports.

What to Look For

A port scan typically appears as:

• One source IP
• Many destination ports