I watched like a 20minute video on YouTube, understood the basics, how to apply filters, conversations, endpoints, some of the protocols, etc.

Nothing too crazy.

Then I thought, okay, enough theory. Let's actually analyze some traffic.

So I went straight to solving PCAPs from Malware-Traffic-Analysis.net.

Bad idea.

I struggled.

Then I struggled some more.

And then I struggled even more.

But nevertheless, I solved it.

And the funny part is, this took me basically the whole day. I mean, I was still doing this until around 12 AM.

So here is how I did it. [I wasn't trying to understand every single packet. I was just trying to answer the questions one by one.]

The PCAP

The exercise I picked was:

2026-09-11 — Traffic Analysis Exercise: Kongtuke rebuke!

I downloaded the PCAP, opened it in Kali Linux, and loaded it into Wireshark.

There were 73,779 packets.

Yeah.

Looking at that number for the first time was not exactly encouraging.

My first instinct was basically:

"Okay... where the hell do I even start?"

So I started looking around.

First: looking at the traffic

I checked the protocols and started seeing things like:

TCP

UDP

DNS

TLS

QUIC

I also opened Statistics → Conversations and Statistics → Endpoints to see which machines were communicating the most.

One IP immediately stood out:

10.9.11.135

I noticed it communicating with:

10.9.11.2

and several external IP addresses.

At this point I didn't know whether 10.9.11.135 was actually the infected machine.

I just had a suspicion.

So I started following the traffic.

Then I found the Windows environment

I noticed some interesting ports:

53 → DNS

389 → LDAP

88 → Kerberos

This started making more sense.

It looked like I was dealing with a Windows Active Directory environment.

10.9.11.2 appeared to be the domain controller.

The domain was:

overhands.org

So now I had a basic picture:

Windows client -> 10.9.11.135

Domain Controller -> 10.9.11.2

Domain -> overhands.org

This was the first point where I stopped randomly clicking packets and started thinking about what each piece of traffic actually meant.

Finding the suspicious domains

I started looking at the DNS queries.

Some of the domains I came across were:

quadcinema.com,

aatthews.cfd,

jquary.com,

edge.microsoft.com

There were also some domains that looked like they were trying to resemble legitimate domains.

One that caught my attention was:

aatthews.cfd

I followed its DNS traffic and found these IP addresses:

172.67.205.86 104.21.22.148

The interesting thing was that the infected host was actually communicating with:

172.67.205.86

I followed the UDP stream and ended up looking at QUIC traffic.

And this was one of those moments where I thought:

"Okay, what am I even looking at?"

There was a lot of encrypted/protected data.

Some readable pieces appeared, but most of it looked like complete garbage.

This was probably one of the points where I spent way too much time staring at packets hoping they would magically explain themselves.

They didn't.

Going back to the actual questions

Eventually I stopped trying to understand every single packet.

The exercise had specific questions.

So instead of trying to understand all 73,779 packets, I started working backwards from what I actually needed to find.

The first thing I wanted to confirm was the infected machine.

I filtered for:

ip.addr == 10.9.11.135

Now I could focus on traffic involving that machine instead of the entire capture.

That made things much easier.

Finding the MAC address

Once I had the IP, finding the MAC address was pretty straightforward.

I opened a packet coming from:

10.9.11.135

Then expanded:

Ethernet II

The source MAC was:

08:d4:0c:7a:29:1e

So I had:

IP: 10.9.11.135

MAC: 08:d4:0c:7a:29:1e

Finding the hostname

Next I needed the hostname.

This is where I learned about NBNS.

NBNS stands for NetBIOS Name Service.

Basically, it is an older Windows networking protocol used for resolving NetBIOS names.

In Wireshark I could filter for:

nbns

or:

udp.port == 137

I looked at the Windows name-resolution traffic involving the infected machine.

Eventually I found:

DESKTOP-6T17ZFM

So now:

IP: 10.9.11.135

MAC: 08:d4:0c:7a:29:1e

Hostname: DESKTOP-6T17ZFM

Finding the username

Then I remembered something I had already seen earlier:

TCP/UDP 88

Port 88 is used by Kerberos, which is heavily used for authentication in Active Directory environments.

So I filtered for Kerberos traffic involving the infected machine.

I was looking for anything that could identify the user account.

I eventually found:

'gmcdowell'

And that gave me the account name.

I also learned something useful here about Wireshark.

You don't necessarily need to manually inspect thousands of packets.

You can search the capture.

For example:

frame contains "gmcdowell"

Wireshark then shows you packets containing that string.

You can look at the packet number in the No. column and inspect that particular frame.

That was a pretty useful "ohhh" moment for me.

Finding the full name

Now I had:

'gmcdowell'

But the question wanted the person's full name.

So I searched for the account again and looked at the surrounding Windows/SMB traffic.

Eventually I found:

'Gabriel McDowell'

So the username and full name were:

Username: gmcdowell

Full name: Gabriel McDowell

Final answers

After all that struggling, I finally had:

Infected IP: 10.9.11.135

MAC address: 08:d4:0c:7a:29:1e

Hostname: DESKTOP-6T17ZFM

Username: gmcdowell

Full name: Gabriel McDowell

What I actually learned

Honestly, I think I learned more from getting stuck than I did from the 20minute Wireshark video(though the video was necessary, otherwise i wouldn't have even known where to start).

The video taught me what things like filters, conversations and endpoints were.

The PCAP forced me to actually use them.

I learned that you don't have to understand every packet in a capture.

You need to ask a question and then narrow the traffic down until you can answer it.

For example:

Find the infected machine

↓

Find its IP

↓

Find its MAC

↓

Find its hostname

↓

Look at Windows authentication

↓

Find the username

↓

Find the user's full name

I also learned a few filters that I'll definitely be using again:

ip.addr == 10.9.11.135 nbns ip.addr == 10.9.11.135 && kerberos frame contains "gmcdowell"

And probably the biggest lesson:

Don't just stare at 73,779 packets and hope something makes sense.

Have a question.

Filter.

Investigate.

Follow the evidence.

And if you still don't understand it...

Google it.

Then go back to the PCAP.

Final thoughts

This was my first proper attempt at analyzing a PCAP.

Was it clean?

Absolutely not.

Did I know what I was doing the whole time?

Not even close.

Did I get frustrated?

A lot.

Did it take basically the entire day?

Yep.

But I solved it.

And honestly, that's probably the best part of learning cybersecurity for me.

I don't want to just watch someone explain Wireshark.

I want to get thrown into a PCAP, have absolutely no idea what's happening, struggle with it for hours, and eventually have that moment where something finally clicks.

So...

one PCAP down.

Let's see how the next one goes.