This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Is there any malware involved?

0

Hi every one, How can i understand that Is there any malware involved in the network by checking Wireshark results?

asked 22 May '15, 12:52

samira's gravatar image

samira
6557
accept rate: 0%


One Answer:

0

There is no simple way to figure out if there is a malware infection, by looking at capture files, as there are tons of different malware types out there and they all behave differently. There are some indicators, like a lot of connections or a lot of traffic form a single client (Statistics -> Conversations), "strange" DNS queries, etc.

So, if you are not looking for a specific malware, where you know what to look for, it's going to be a tough job, which involves a lot of experience with malware in general, networking protocols, a fairly good knowledge what's "normal traffic" on your network, etc.

You should start by reading the other questions tagged with malware, to get an idea.

https://ask.wireshark.org/tags/malware/

Regards
Kurt

answered 24 May '15, 03:04

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%