Start narrow and work your way wider when looking at the packets. are a good way to point yourself in the right direction of things to look at initially. First, the indicators you received, alerts, users calling, etc. Question submitted from reader: 'What are the top 10 or so questions (what & why ask) you would ask yourself when looking at packets you suspect contain evil?' Two things with this question. I'm going to include that question and list, then add to it. The reader submitted an question and initial list of things he/she thought they should look at first. However, there are some fundamental things to start with. Each person will have their own style and approach to looking at packets and traffic.

Over my years of looking at packets, I have become completely convinced that packet analysis is well and truly art form (and alot of learning). I was so anxious to learn it and become really good at it but had no idea where to start. I think back many, many (its been a while) years ago when I first started looking at packets. For many of people, packets are a mystery. Since Guy was asking for packets earlier in the evening, it was a timely question.

They are wanting to expand their skills at packet analysis. We had a reader who sent an email to us tonight asking for some guidance 'when tearing into packets'.

Wireshark sample captures