When reviewing pcaps from malware activity, it’s very helpful to know what’s contained within post-infection traffic. But like most websites, various types of malware also use HTTPS. Why? Because most websites use the Hypertext Transfer Protocol Secure (HTTPS) protocol. When reviewing suspicious network activity, we often run across encrypted traffic. The instructions assume you are familiar with Wireshark, and it focuses on Wireshark version 3.x.

And I doubt it is being done in the driver because another machine running the same driver with the same cards does not have this behavior.This tutorial is designed for security professionals who investigate suspicious network activity and review packet captures (pcaps) of the traffic. Is this common? From what I can tell, the application is not doing this. They all have the same source mac address.ĩ acks come back, each addressed to the unique 9 IP addresses and unique 9 MAC addresses. On the other hand, when the XP embedded machine responds with TCP acks, each ack packet is correctly paired with a unique IP and unique MAC address.ĩ packets sent from 9 different/unique physical ethernet ports on the same computer.

However, they all have the same exact MAC address when sending. When I do a wireshark capture, I see that all the packets going out of the computer correctly transmit from 9 different IP addresses. I have assigned in the application, each eth port to be a unique address, and have verified when I do an 'ifconfig' that each physical port has a unique mac address as well. The computer has 10 physical ethernet ports, 9 of which are on this network. I'm seeing an issue with a computer (running an embedded OS) transmitting over a network to an XP embedded machine.

Ip address wireshark