Sample reports

Sample PCAP analysis reports

Twenty real packet captures, each analyzed in full and written up the way an incident responder would read it: what the traffic shows, how to recognise it, and how to respond. Every report names the hosts, protocols, DNS lookups, HTTP sessions, credentials, carved files and host map the capture holds, with the exact indicators, Wireshark filters and MITRE ATT&CK techniques, and links the interactive report of the same file.

The captures span the cases that bring analysts to a PCAP: macOS infostealers and a Cobalt Strike beacon, cleartext credentials over FTP, Telnet and mail, web attacks against a vulnerable app, Nmap and sqlmap reconnaissance, ARP spoofing, DNS tunneling and Heartbleed. Most come from public sources, with the source linked on each page: malware samples from malware-traffic-analysis.net, protocol examples from public sample sets, and a few scans captured in an A-Packets lab. Each page states where the capture came from, or says so plainly where the origin could not be confirmed.

For a task that spans several captures, such as auditing a network for cleartext passwords or telling a DNS tunnel from a subdomain sweep, the PCAP analysis use cases set these reports side by side.

Read these before uploading anything of your own: they show exactly what A-Packets extracts from a capture and where it stops. It rebuilds sessions and lists what they carried; it does not decrypt TLS payloads, so for an encrypted channel it reports the server names, certificates and traffic shape rather than the contents. Its findings are a starting point for an analyst, not a verdict. When you are ready, upload a PCAP for free public analysis, or keep incident captures private with a paid plan.

Malware traffic

  • FTP view of the GuLoader FTP exfiltration PCAP in A-Packets
    GuLoader to AgentTesla, FTP exfiltration

    An infected host downloads a payload from Google Drive and ships stolen passwords to a drop server over cleartext FTP.

    353 packets · pcap

  • HTTP view of the macOS malware traffic PCAP in A-Packets
    macOS stealer HTTP C2

    A macOS infostealer checks in over plain HTTP, reports each collection stage and posts the stolen data to its command server.

    20555 packets · pcap

  • HTTP view of the AMOS stealer PCAP in A-Packets
    Atomic macOS Stealer (AMOS)

    The AMOS infostealer talks to one command server over HTTP, walks through its collection stages and uploads what it found.

    12956 packets · pcap

  • SSL/TLS view of the SHub Stealer PCAP in A-Packets
    SHub Stealer (macOS)

    A macOS stealer reaches an attributed TLS command endpoint and a set of throwaway look-alike domains while the capture holds no cleartext payload.

    14874 packets · pcap

  • SSL/TLS view of the Cobalt Strike beacon PCAP in A-Packets
    Cobalt Strike beacon

    A beacon checks in to a look-alike domain over TLS on a Cloudflare port every 20 seconds, hidden among ordinary Windows background traffic.

    1754 packets · pcapng

Credentials

  • Credentials view of the FTP and Telnet password PCAP in A-Packets
    FTP and Telnet passwords

    Two cleartext protocols that carry the login and password in plain view: an FTP sign-in and a Telnet session, side by side.

    151 packets · pcap

  • Credentials view of the SMTP and IMAP login PCAP in A-Packets
    SMTP and IMAP logins

    Mail sign-ins captured as AUTH LOGIN, AUTH PLAIN and CRAM-MD5, distinguishing exposed passwords from challenge-response proofs.

    471 packets · pcap

  • HTTP view of the HTTP form login PCAP in A-Packets
    HTTP form login

    A sign-in form posted over plain HTTP, so the username and password travel in the request body for anyone on the path to read.

    54 packets · pcapng

Web attacks

  • HTTP view of the directory traversal PCAP in A-Packets
    Directory traversal

    A file-inclusion request walks out of the web root with ../ and the server returns the contents of a system file in its response.

    10 packets · pcapng

  • HTTP view of the SQL injection PCAP in A-Packets
    SQL injection

    Three SQL injection requests produce user records, a syntax error and a database-version response, all with HTTP status 200.

    35 packets · pcapng

  • HTTP view of the SQL injection password dump PCAP in A-Packets
    SQL injection password dump

    A single UNION SELECT returns five account records and their password hashes inside the HTTP response.

    12 packets · pcapng

  • HTTP view of the sqlmap PCAP in A-Packets
    sqlmap scan

    The sqlmap tool fires dozens of injection probes at one parameter, each visible as an HTTP request with its own tell-tale payload.

    212 packets · pcap

Reconnaissance

  • HTTP view of the Nmap HTTP scan PCAP in A-Packets
    Nmap NSE HTTP scan

    Eight HTTP requests probe a web server: four script probes identify the Nmap Scripting Engine, while four root requests omit a user agent.

    16 packets · pcap

  • Capture evidence diagram for the Nmap ACK scan PCAP
    Nmap ACK scan

    One host sends 1,088 bare ACK probes across 1,000 ports; 1,000 resets characterize ACK filtering on the tested path.

    2088 packets · pcap

  • Capture evidence diagram for the Nmap SYN scan PCAP
    Nmap SYN scan

    A SYN scan probes 1,000 ports. Three return SYN-ACK, four return resets, and most have no recorded response.

    2011 packets · pcapng

  • DNS view of the DNS enumeration PCAP in A-Packets
    DNS subdomain enumeration

    A client asks for hundreds of guessed names under one domain, most of them failing, and tries an AXFR zone transfer against its servers.

    5204 packets · pcap

Network and transport

  • Capture evidence diagram for the ARP poisoning PCAP
    ARP poisoning

    Forged ARP replies bind the gateway address to the attacker's MAC, and the victim's web and DNS traffic then flows through it.

    165 packets · pcapng

  • Capture evidence diagram for the arpspoof PCAP
    arpspoof gateway attack

    The arpspoof tool repeats forged replies for the gateway so a busy victim's TLS and web browsing is relayed through the attacker.

    16285 packets · pcap

  • DNS view of the iodine DNS tunnel PCAP in A-Packets
    iodine DNS tunnel

    One client sends 222 unique NULL queries under a single domain, exposing iodine negotiation and encoded tunnel traffic.

    438 packets · pcap

  • SSL/TLS view of the Heartbleed PCAP in A-Packets
    Heartbleed (CVE-2014-0160)

    A TLS heartbeat request asks for far more data than it sent, and the server answers with a large response: CVE-2014-0160 in one exchange.

    30 packets · pcap