Please enable JavaScript.

Coggle requires JavaScript to display documents.

(Email case investigation) - Coggle Diagram

- - - - data-text-lines contains "web page title"
        
        You will get
        
        source IP
        
        Dest. IP
        
        Protocol
        
        Lenth
        
        Other information
    - - (ip.src == xx.xx.xx.xx ) && (ip.dst == xx.xx.xx.xx) && http.request.method == "POST"
        
        If the request is "POST" then you can see it in the info
        
        it will show any MAC address associated with this request
    - - By using MAC address
    - - eth.addr == 00:17:f2:e2:c0:ce && http.cookie contains ""
  - - - Counting the numbers of packets that contain the key word “first”
        
        Tshark -r basic.log –qz io,stat,0,”COUNT(frame) frame” , “data-text-lines contains first”
      - Find a specific packet with a frame number
        
        tshark -r basic.log -Y "frame.number == 6"
      - Find frame numbers if packets have HTTP content
        
        tshark -r basic.log -Y "data-text-lines contains "first""
      - Finding protocol and field name
        
        tshark -G fields | grep -E "http." --color
        
        tshark -G protocols | grep -Ei “\btcp\b" --color
        
        tshark -G fields | grep -E "frame.number" --color
      - Find packet details -V
        
        tshark -r basic.log -Y "frame.number == 6" -V
      - Find lines in packets contain the key word “first” and highlights them
        
        tshark -r basic.log -Y "frame.number == 6" -V | grep -i "first" --color
  - - - tshark -r xyz.pcab | head -n 10
        
        This command will show first 10 lines of traffic data
      - tshark -r xyz.pcab | tail -n 10
        
        This command will show last 10 lines of traffic data
      - Counting the number of packets
        
        tshark -r xyz.pcap -qz io,stat,0,"COUNT(frame) frame"
      - Showing the first n packets
        
        tshark -r nitroba.pcap -T fields -e frame.time -e frame | head -n n
      - Search title keywords in the .html page
        
        tshark -r nitroba.pcap -Y "data-text-lines matches \"secure anonymous E-mail\"" 2>/dev/null
      - Finding request method
        
        tshark -r nitroba.pcap -Y (ip.src == 192.168.15.4 ) && (ip.dst == 69.25.94.22) && http.request.method == "POST"
      - Search all packets sending and receiving in the request using MAC address
        
        tshark -r nitroba.pcap -qz io,stat,0,"COUNT(frame) frame","eth.addr == xx:xx:xx:xx:xx:xx"
      - Extracting useful information from cookies using MAC add
        
        eth.addr == xx:xx:xx:xx:xx:xx && http.cookie contains ""