This Wireshark tutorial reviews a recent packet capture (pcap) from a Qakbot infection. The properties of both hardware appliances and packet analyzer software are reviewed from the perspective of their potential use in network forensics. This family of malware has been active for years, and Qakbot generates distinct traffic patterns. Considering that not all network information can be used in court, the types of digital evidence that might be admissible are detailed. This paper is a comprehensive survey of the utilization of packet analysis, including deep packet inspection, in network forensics, and provides a review of AI-powered packet analysis methods with advanced network traffic classification and pattern identification capabilities. This can be used to find traces of nefarious online behavior, data breaches, unauthorized website access, malware infection, and intrusion attempts, and to reconstruct image files, documents, email attachments, etc. Packet analysis is a primary traceback technique in network forensics, which, providing that the packet details captured are sufficiently detailed, can play back even the entire network traffic for a particular point in time.

Malware traffic analysis wireshark