An internal host at IP address 10.10.50.100 is suspected to be communicating with a command and control whenever a user launches browser window. What…

The scenario requires isolating and analyzing potential Command and Control (C2) traffic initiated when a user launches a web browser from the host 10.10.50.100. The most effective method is to first apply a specific display filter. The filter ip.src == 10.10.50.100 correctly isolates all traffic originating from the suspect host. Since the trigger is a browser, filtering on tcp.dstport == 80 narrows the capture to outbound HTTP requests, a common channel for C2 communication. After filtering, using the "Follow TCP Stream" feature is essential. This tool reconstructs the TCP conversation, allowing the analyst to view the full application-layer data (e.g., HTTP headers and content) in a human-readable format to identify malicious commands or responses.

A. The filter tcp.srcport == 80 is incorrect. A client browser uses a random high-numbered (ephemeral) source port; the destination port for the web server is 80.

B. The filter tcp.dstport == 53 targets DNS traffic. While DNS can be used for C2, the scenario specifies a browser launch, making HTTP (port 80) the primary protocol to investigate.

D. This filter is too broad. While ip.src == 10.10.50.100 is a correct starting point, it will show all outbound traffic, not just the browser-related activity, making it inefficient to isolate the specific C2 traffic.

1. Wireshark User's Guide, Chapter 6. Display Filters. The official documentation details the syntax for creating display filters. Section 6.4.3, "TCP and UDP Ports," specifies using tcp.dstport to filter based on the TCP destination port. The filter ip.src == 10.10.50.100 and tcp.dstport == 80 is a standard combination for isolating a client's web traffic.

(Reference: Wireshark.org, Wireshark User's Guide, "Section 6.4. Common Filter Fields").

2. Wireshark User's Guide, Chapter 7. Following Protocol Streams. This section explains the "Follow TCP Stream" feature: "Wireshark can reconstruct the data from a TCP stream and display it in a separate window." This is the standard procedure for analyzing the content of a conversation, such as an HTTP-based C2 session.

(Reference: Wireshark.org, Wireshark User's Guide, "Section 7.4. Following Protocol Streams").

3. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. The companion "Wireshark Lab: TCP" for this widely used university textbook demonstrates the exact process of isolating a TCP flow and inspecting its contents. The lab guides students to filter traffic and then right-click a packet to "Follow TCP Stream" to analyze the exchanged application data (e.g., HTTP GET requests).

(Reference: Wireshark Lab: TCP, Section 4: "TCP Connection Teardown," which uses the Follow TCP Stream feature for analysis).

4. Sikorski, M., & Honig, A. (2012). Practical Malware Analysis. No Starch Press. Chapter 16, "Malware-Focused Network Signatures," discusses analyzing network traffic for malware. It highlights the importance of filtering on source/destination IPs and ports (like port 80 for HTTP) and then reconstructing streams to analyze the payload for C2 indicators, validating the methodology in the correct answer.

(Reference: Chapter 16, pp. 385-388).