One of these is not like the others
When malware infects a machine, it usually “phones home” to a domain the attacker controls — its command-and-control (C2) server. So in a list of DNS lookups, most names are normal (www.debian.org, update.ubuntu.com), but one may look odd: a name you do not recognise, often made to sound like a real update service.
Your job is to read the list and flag the one that does not belong. List the unique names and eyeball them:
tshark -r /home/student/case/capture.pcap -Y dns -T fields -e dns.qry.name 2>/dev/null | sort -uIn the terminal
student@vulntech:~$ tshark -r /home/student/case/capture.pcap -Y dns -T fields -e dns.qry.name 2>/dev/null | sort -u sync-update-cdn.net www.debian.org
Tip: You will not always be sure from the name alone — but a domain pretending to be a “cdn” or “update” service that you have never heard of is exactly what to write down and investigate further.