A plan for any capture

Four questions, every time

When someone hands you a capture and says “is this bad?”, do not panic or scroll randomly. Ask the same four questions you have practised, in order:

• Who is talking? — count packets, list the addresses.
• Is anyone scanning? — one source, many destination ports, all SYN.
• Any odd names? — list the DNS lookups and spot the phone-home.
• Anything in the clear? — read HTTP with tcpdump -A for pages and passwords.

Each question is one or two commands you already know. Put the answers together and you have the story of the capture.

Tip: Work the questions in that order: knowing who and scanning first tells you which addresses to focus on when you read the names and the cleartext.