Packet Sifter and Leveraging TShark for Network Traffic Analysis

Ross Burke opens with a common frustration for SOC analysts: Wireshark becomes slow and unwieldy when a packet capture grows to gigabytes. He presents TShark, the command-line counterpart to Wireshark, as a faster way to reach the same protocol analysis. He walks through basic usage, including reading a capture with name resolution turned off, applying display filters, writing filtered results to a new file, and printing protocol hierarchy statistics. He also shows field extraction, which pulls specific values such as HTTP user agents, and how standard Unix tools like sort and uniq can aggregate those values to surface rare entries.

The middle of the talk introduces PacketSifter, a bash script he built on top of TShark. It generates protocol statistics and traffic breakdowns in 30-second intervals, splits a capture into smaller files by protocol, and extracts HTTP and SMB objects into an archive. When API keys are configured, it hashes extracted files for VirusTotal lookups and checks resolved IP addresses against AbuseIPDB for confidence scores and geolocation.

In the live demo, he runs the tool against a sample capture and reviews the output files. He points to a raw IP address used as an HTTP host header, a suspicious domain that resembles a legitimate update service, and a file with an image extension that matched a known malware family in VirusTotal. His takeaway is that scripted triage can quickly surface indicators worth investigating, while analysts should still verify crowd-sourced reputation data before acting on it.