Malware › Module 7 › Lesson 1
PCAP Literacy
PCAP literacy from $MAL_LAB captures — read frames, flows, and protocols without attacking live stranger infrastructure.
Visual · t22_pcap_literacy
PCAP = packet capture timeline. $MAL_LAB sink only. Original Cyberlium.
Opening
Network tells the callback story — learn to read PCAP from your isolated lab, not to pen-test random IPs you saw in a sandbox report.
Packet captures record network conversations during dynamic analysis: Ethernet, IP, TCP/UDP, DNS, HTTP/S, TLS handshakes. Analyst literacy opens $MAL_LAB PCAP in Wireshark-class tools, follows TCP streams, identifies DNS queries post-detonation, notes beacon-like intervals at category level — without interacting with live attacker infrastructure outside isolated sink. Cyberlium teaches frame fields (Source, Destination, Protocol, Info) and flow correlation with UTC proc monitor timeline — NOT scanning stranger C2 IPs from VirusTotal comments, NOT MITM-ing production networks, NOT replaying captures to weaponize callbacks. Redact external IPs in notes unless brief allows; chmod 600 storage.
1. PCAP basics
Capture filter vs display filter — know which ran during $MAL_LAB detonation.
Follow TCP stream for HTTP cleartext in lab; TLS shows SNI and JA3-class metadata at literacy level.
Command guide
Try these commands — PCAP basics
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
tcpdump basics — https://man7.org/linux/man-pages/man8/tcpdump.8.html (lab host capture only) Network IOCs — https://attack.mitre.org/ (command-and-control literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install tcpdump
Built-in (iproute2)
macOS: Use: netstat
Windows: Use Wireshark or install via WSL Use: netstat
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_HOST=${LAB_HOST:-127.0.0.1}
sudo tcpdump -i any -c 5 -n 2>/dev/null || tcpdump -i lo -c 5 -n 2>/dev/null || echo 'tcpdump needs sudo or lo — lab host only'
ss -tulpn 2>/dev/null | head -10Primary tools to practice this lesson: tcpdump, ss. Reference sites: tcpdump basics (https://man7.org/linux/man-pages/man8/tcpdump.8.html); Network IOCs (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Correlation
Align first suspicious DNS query UTC with proc monitor Process Create — single timeline for report.
Note periodicity category: burst, interval beacon, failed resolve — not precision evasion tuning.
3. Safety boundary
PCAP from $MAL_LAB isolated run only — do not capture roommate traffic or employer LAN without authorization.
IOC extraction is domain/IP/hash literacy — not live interaction with unknown C2 from host OS.
4. What you ship: PCAP literacy card
Five Wireshark fields + flow follow steps + timeline correlation rule + redaction note.
5. What you record before the next lesson
PCAP literacy card path.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run nmap against C2 IPs extracted from stranger PCAP on host OS.
Right
PCAP literacy card from $MAL_LAB capture. Next: DNS/HTTP Cues.
Mission: PCAP literacy card
1) Name five useful display columns. 2) Write follow-TCP-stream steps. 3) Correlate one DNS query to proc event. 4) Redaction rule for external IPs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “DNS query vs HTTP POST — which IOC type?”
Knowledge Check
APPLY: PCAP literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Attack live C2 IPs from sandbox reports on host.
True or False
Knowledge Check
APPLY: PCAP correlates with:
Multiple choice