Look for when (time) a file was downloaded -> To see if data exfiltration or strange behavior started soon after.

Look for a file that was downloaded -> Looking for malicious files to see if machine got infected.

Look for what IP went to an IP of interest -> Who followed a link, uploaded some data, etc.

The packets are innocent until proven guilty:) Here's a past diary example of suspicious behavior being 'normal':

Look at packets from a clean slate of what are they telling you! Don't assume one way or other. Don't automatically assume evil! Why you might ask? Because I have watched people try to force packets into being malicious in nature to support their theory, when in reality something was just broke or it was normal behavior! Yet they were convinced something evil was going on and had management all spun up. Second, I would modify the thought process when looking at packets. Start narrow and work your way wider when looking at the packets. are a good way to point yourself in the right direction of things to look at initially. First, the indicators you received, alerts, users calling, etc. Question submitted from reader: 'What are the top 10 or so questions (what & why ask) you would ask yourself when looking at packets you suspect contain evil?' Two things with this question. I'm going to include that question and list, then add to it. The reader submitted an question and initial list of things he/she thought they should look at first. However, there are some fundamental things to start with.

Each person will have their own style and approach to looking at packets and traffic. Over my years of looking at packets, I have become completely convinced that packet analysis is well and truly art form (and alot of learning). I was so anxious to learn it and become really good at it but had no idea where to start. I think back many, many (its been a while) years ago when I first started looking at packets. For many of people, packets are a mystery. Since Guy was asking for packets earlier in the evening, it was a timely question. They are wanting to expand their skills at packet analysis. We had a reader who sent an email to us tonight asking for some guidance 'when tearing into packets'.

Wireshark pcap file analysis