Welcome to this network forensics simulation. You will analyze captured network traffic to isolate specific application-layer artifacts, a critical skill for examining data exfiltration and C2 communications.
During a digital forensics investigation of a corporate breach in Atlanta, Georgia, preliminary evidence indicates that unauthorized data exfiltration occurred over HTTP. The network administrator provided an offline packet capture (PCAP) acquired from the perimeter span port during the suspected incident window. The investigator suspects the data was sent to the domain example.com.
Item Number: EVD-2023-094-NET
Evidence Type: Network Packet Capture (.pcapng)
Hash (SHA-256): 8a42b98f2...
File Size: 1.2 GB (approx. 2.4 million frames)
During a network-forensics investigation in Atlanta, Georgia, an analyst is using Wireshark to capture and analyze network traffic. The analyst wants to filter the traffic to show only HTTP requests made to a specific domain. Which Wireshark display filter should be used?
The collected 1.2 GB PCAP file contains a massive volume of mixed network traffic. Analyzing raw frames without precise application-layer filters is computationally expensive and cognitively overwhelming for an investigator.
Examination and Analysis. The physical data has already been preserved and collected. The current objective is to carve and isolate relevant digital artifacts (HTTP requests) from the raw binary capture.
The filter http.host == "example.com" explicitly parses OSI Layer 7 (Application Layer) and filters the output to only show frames where the HTTP "Host" header exactly matches the target domain. This isolates the specific C2/exfiltration traffic regardless of the IP address the domain resolves to.
tcp.port == 80: This filters by transport layer (Layer 4). It will show all unencrypted web traffic to any domain, introducing massive amounts of noise (irrelevant evidence) into the analysis.ip.addr == 192.168.1.1: This filters by network layer (Layer 3). CDNs and cloud hosts often use dynamic IPs, or multiple domains may share a single IP. It does not target the specific application payload.eth.addr == ...: This filters by data link layer (Layer 2) physical MAC address. It only tracks a local physical interface (like a router or local NIC) and reveals nothing about the destination domain.In practice, once the investigator applies the http.host filter to isolate the malicious frames, they will right-click the packet, select "Follow > HTTP Stream" to view the raw GET/POST requests and responses, and then use File > Export Objects > HTTP to extract exfiltrated files or downloaded malware payloads for offline hashing and static analysis.
Digital forensics demands precision. When isolating artifacts, investigators must align their search criteria with the correct OSI layer. Network protocols are encapsulated. Searching for a domain name (Layer 7 data) using a Layer 3 (IP) or Layer 4 (Port) filter is a common analytical error that violates the principle of exact artifact isolation. Always use protocol-specific parsers in your examination tools to establish an accurate and irrefutable chain of evidence.
Enhance your evidence analysis skills and prepare for the CHFI exam with realistic scenarios.
Explore more CHFI simulations