Warning: Some of the pcaps used for this tutorial contain Windows-based malware. You will need to access a GitHub repository with ZIP archives containing the pcaps used for this tutorial. Note: These instructions assume you have customized Wireshark as described in our previous Wireshark tutorial about customizing the column display. Today’s Wireshark tutorial reviews recent Emotet activity and provides some helpful tips on identifying this malware based on traffic analysis. It has since evolved with additional functions such as a dropper, distributing other malware families like Gootkit, IcedID, Qakbot and Trickbot. Familiarity with Wireshark is necessary to understand this tutorial, which focuses on Wireshark version 3.x.Įmotet is an information-stealer first reported in 2014 as banking malware. RTT says consistent at about 22ms (there are a few spikes to 90s but I cant see any Dup Acks or Retranmissions at the same time?) So Dup Ack's indicate packet loss? But again, the throughput trace looks clean, as does the window scaling.This tutorial is designed for security professionals who investigate suspicious network activity and review packet captures (pcaps).

Here's my problem-I have a trace where I can see loads of Dup Ack's (sometime 300-400-but only 2 retransmissions-10 second trace over a high speed cable link). Retransmissions-Retransmissions are initiated by the sender if there is no response within it's retransmission timer-so it doesn't need to be told by the client/receiver something has been lost-it just resends?ĭup Acks-Dup Acks are sent by the client/receiver back to the sender, telling the sender something is out of order First post and something I have been wrestling with a while-its all around TCP Dup Ack's and Retransmissions.I have watched and read some excellent stuff from Chris Greer, so I have tried to research it :-)įirstly, can I put down what I think each is-and then be rebuked if necessary:

Filter tcp retransmission wireshark