Python/Pyshark for deep network analysis
We have learned about packet analysis using automated tools, but sometimes, during malware analysis, data exfiltration, and tunneling attacks such as DNS tunneling require a packet-by-packet deep analysis, which in Wireshark is a bit complex. Using Python modules such as Pyshark is a useful way to understand and locate malicious targets.
So, let’s perform packet analysis using Pyshark. Installation of Pyshark is very easy, as shown in the following screenshot:
Figure 8.12 – Pyshark installation
As shown in Figure 8.12, Pyshark has been successfully installed in Windows as a Python module package. So, let’s import Pyshark and start the live traffic capture:
Figure 8.13 – Pyshark live packets capturing
As shown in Figure 8.13, using pyshark, live packets are successfully captured. So, let’s open the live packet captured in Wireshark to validate:
