Packets don’t lie — a network forensics guide with tcpdump, Wireshark, and Zeek

In May 2025, a ransomware operator hit a mid-sized European manufacturing firm. Before encrypting every disk, they wiped the Windows event logs, corrupted the bash history, and disabled the EDR agent. One single source of truth survived: the PCAP captured by the SOC’s network TAP, containing every packet exchanged between the compromised workstation and the C2 server over the 72 hours leading up to encryption. In January 2026, CERT-FR documented an exfiltration campaign where the SIEM logs showed nothing but “normal activity.” It was a three-week-old PCAP — and a deep dive into its DNS flows — that exposed the tunneling.

Application logs lie when the attacker has root. SIEM alerts are blind to custom protocols. Network packets don’t lie — and that’s the entire discipline of network forensics.

tcpdump — the surgical scalpel in a single line

tcpdump is the oldest and most universal capture tool in existence. Written in 1988 by Van Jacobson, Sally Floyd, Vern Paxson, and Steven McCanne at Lawrence Berkeley Laboratory, it remains in 2026 the first reflex of every administrator facing a network incident. The current stable release, 4.99.6 (December 2025), paves the way for the upcoming 5.0 and depends on libpcap 1.10.6, which notably fixes vulnerabilities CVE-2025-11961 and CVE-2025-11964.

tcpdump’s power comes down to one thing: BPF (Berkeley Packet Filter). This filtering language compiles to bytecode that runs inside the kernel — before packets even reach userspace — letting you surgically isolate relevant traffic without filling your disk. A well-written BPF filter is the difference between capturing 50 GB of noise and 2 MB of evidence.

Here are the BPF filters that resolve 90% of incidents:

# All traffic between a suspect host and the Internet (excluding admin SSH)
tcpdump -i eth0 -w incident.pcap 'host 192.168.1.47 and not port 22'

# DNS queries only (port 53) — often the first C2 indicator
tcpdump -i eth0 -w dns.pcap 'port 53'

# Outbound SYN without ACK (post-compromise network reconnaissance)
tcpdump -i eth0 -w syn-scan.pcap 'tcp[tcpflags] & (tcp-syn) != 0 and tcp[tcpflags] & (tcp-ack) == 0'

# C2 beacon hunting: every 60 seconds, 512-byte packet
tcpdump -i eth0 -w beacon.pcap 'len == 512'

The -w flag writes to a PCAP file — the universal network forensics format — that you can later reopen with Wireshark or Zeek. The -C 100 option auto-segments into 100 MB chunks for long-running captures. And -G 3600 -w capture_%Y%m%d-%H%M.pcap rotates hourly on a monitoring server.

tcpdump’s blind spot is post-capture analysis. Reading a PCAP in the terminal (tcpdump -r) works, but beyond a few hundred packets, the human brain disengages. That’s where Wireshark takes over.

Wireshark — the microscope that turns bytes into conversation

Wireshark (formerly Ethereal, renamed in 2006 due to trademark issues) is the reference graphical analyzer. Version 4.6.7, released on July 8, 2026 — the day before this article — fixes a significant number of vulnerabilities originating from AI-assisted reports, a sign that even the network analysis tool has become a target. The Wireshark Foundation, established in 2023 under Sysdig’s stewardship, guarantees the project’s long-term health.

Where tcpdump shows lines, Wireshark tells a story. Three capabilities that change everything in forensics:

TCP stream following. Right-click → Follow → TCP Stream. Wireshark reconstructs the complete conversation between two endpoints: HTTP requests, responses, file transfers. In forensics, this is your first action after loading a PCAP. Did the attacker download a payload over HTTP? The TCP stream shows you the GET request, the 200 response, and the binary in cleartext if the transfer wasn’t encrypted.

Display filters. Unlike BPF filters that operate at capture time, Wireshark’s display filters work on an already-saved PCAP. The syntax is different and more expressive:

# All HTTP traffic to a suspect IP
http && ip.dst == 203.0.113.42

# TCP packets with the RST flag (connection kill attempts)
tcp.flags.reset == 1

# TLS certificates with a suspicious Common Name
tls.handshake.certificate && x509sat.commonName contains "evil"

# DNS queries with abnormally low TTL (fast-flux C2)
dns && dns.resp.ttl < 60

Statistics. The Statistics menu turns a multi-gigabyte PCAP into actionable dashboards: Endpoints ranks IPs by traffic volume, Protocol Hierarchy breaks down by protocol, Conversations shows who’s talking to whom. In 30 seconds, you know whether the compromised host exfiltrated data to an unusual IP — without reading a single packet.

TShark, Wireshark’s CLI counterpart, is the secret weapon of automated forensics. Where tcpdump captures, TShark analyzes:

# Extract every HTTP User-Agent from a PCAP in one command
tshark -r incident.pcap -Y 'http.user_agent' -T fields -e http.user_agent | sort | uniq -c | sort -rn

# List the top 10 IPs by DNS query volume
tshark -r dns.pcap -Y 'dns' -T fields -e ip.src | sort | uniq -c | sort -rn | head -10

Zeek — the interrogator that never sleeps

If tcpdump is the eyewitness and Wireshark the microscope, Zeek is the investigator who reads every case file and prints summary sheets before you even arrive. Created in 1995 by Vern Paxson under the name Bro — an Orwellian nod to Big Brother — and renamed in 2018, Zeek is a Network Security Monitor that turns network traffic into structured, queryable logs. Version 8.2.1, released on July 10, 2026, drives this engine.

Zeek blocks nothing. It passively observes network traffic and generates 70+ log files by default: connections, DNS, HTTP, SSL/TLS, SSH, SMB, Kerberos, and dozens of other protocols. Each log is a timestamped TSV file, designed for SIEM ingestion or direct querying.

The canonical example: a conn.log after 24 hours on a mid-size company network contains thousands of lines. A simple search for connections with a duration under 100 ms and a state of S0 (SYN sent, no response) immediately flags a port scan:

cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p duration conn_state | awk '$4 < 0.1 && $5 == "S0"'

Zeek also catches patterns that classic IDS signatures miss. C2 beaconing over HTTPS looks like legitimate traffic — except Zeek computes the average interval between outbound connections to the same IP. When a host contacts 203.0.113.99 every 127 seconds with a variance under 2%, you’ve got a beacon — even if the payload is encrypted and the certificate is valid.

Installation is standard on any recent Linux:

# Debian/Ubuntu
echo 'deb http://download.opensuse.org/repositories/security:/zeek/Debian_12/ /' | sudo tee /etc/apt/sources.list.d/security:zeek.list
curl -fsSL https://download.opensuse.org/repositories/security:zeek/Debian_12/Release.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/security_zeek.gpg > /dev/null
sudo apt update && sudo apt install zeek

The engine runs on a passive interface — typically a SPAN port or a network TAP — and writes logs to /usr/local/zeek/logs/current/. The community maintains 270+ packages in the Zeek Package Manager (zkg), covering ransomware detection, suspicious TLS certificate analysis, and Elasticsearch integration.

The forensic chain — from packet to proof

A network incident is read in three passes, and the order matters.

Pass 1 — Capture everything, filter later. The cardinal sin of forensics is under-capturing. A BPF filter that’s too aggressive at capture time permanently discards the packets you didn’t anticipate. On a monitoring server, prefer a full capture with rotation:

tcpdump -i eth0 -w /data/pcap/traffic_%Y%m%d_%H%M.pcap -G 3600 -C 500 -W 168

This one-liner retains 168 hours of traffic in hourly slices capped at 500 MB each. Enough to reach back a full week when the SOC detects lateral movement three days late.

Pass 2 — Isolate with Wireshark. Open the PCAP matching the incident’s time window. First action: Statistics → Conversations to identify the anomalous IP. Second: Display Filter on that IP. Third: Follow TCP Stream to read the full conversation. Export the stream as plain text — that’s your first piece of evidence.

Pass 3 — Automate detection with Zeek. Replay the same PCAP through Zeek (zeek -r incident.pcap) and query the resulting logs. Cross-reference conn.log, dns.log, and ssl.log to reconstruct the attack timeline: first anomalous connection, C2 DNS resolution, payload download, post-infection beaconing.

The verdict — one tool per phase, never just one

Network forensics has no silver bullet. It has a complementing trio:

• tcpdump for reliable, lightweight capture. It’s the only tool that runs on a production server with no measurable impact. If you only take one thing away, learn BPF filters — it’s a skill that will serve you on every incident for the rest of your career.
• Wireshark for interactive analysis. TCP stream following and conversation statistics save you hours compared to raw PCAP reading. Install it on your analysis workstation — not on the compromised server.
• Zeek for automated detection and structured log generation. This is the choice for SOCs handling more than one incident per week. The learning curve (mastering the Zeek scripting language) is real, but the payoff is immediate once you need to correlate events across multiple days of traffic.

One final piece of advice that applies to all three: test your capture chain before the incident. A TAP plugged in the wrong direction, a SPAN port that drops packets under load, a BPF filter silently excluding IPv6 traffic — you discover these mistakes the day you need them. Run a 24-hour capture, open it in Wireshark, and verify you’re seeing what you think you’re capturing. On incident day, it will be too late.

References

• Wireshark 4.6.7 Release Notes — July 8, 2026
• tcpdump & libpcap Latest Releases — tcpdump 4.99.6, December 30, 2025
• libpcap 1.10.6 Changelog — CVE-2025-11961, CVE-2025-11964
• Zeek 8.2.1 Release — July 10, 2026
• Zeek Documentation — Log files reference
• Wireshark Foundation Announcement — March 1, 2023
• BPF Reference — tcpdump man page
• Zeek Package Manager (zkg) — 270+ community packages