4.4PCAP analysis (stream reassembly and elements of an intrusion)

Even when an alert or flow says "suspicious," what was actually exchanged is not settled until you look inside the packets. TCP crossing the network arrives as small segments and makes no sense as-is. The heart of pcap analysis is reassembling the scattered segments in order to restore the application-layer conversation (an HTTP GET response, a transferred file), then pinning down who sent what to whom. This section covers the procedure for stream reassembly and file extraction, and reading the elements of an intrusion (the 5-tuple plus payload) from packets to name the victim host and attacker infrastructure.

4.4.1Stream reassembly and file extraction

• TCP splits data into segments that are reordered by sequence numbers (seq/ack). Wireshark's Follow TCP Stream concatenates the segments of one connection (the same 5-tuple) in seq order, restoring the application-layer raw data (HTTP request/response bodies, etc.) with send/receive color-coded. The starting point is to narrow "which stream" with a filter (e.g., tcp.stream eq 3).
• To extract a transferred file, save the reassembled stream's payload, or use Wireshark's File > Export Objects > HTTP (or SMB, etc.) to write out the response body directly as a file. For the carved sample, compute a hash (e.g., sha256), check reputation, and register it as an IOC. This is the standard procedure for confirming "the malware that actually landed" from a pcap.