PCAP Analysis Examples
Network problems and security findings from public sample captures, each with the PDF report PcapAI produced for it: what the report found, who owns the fix and the steps to take.
TCP Retransmission Storm
The Symptom
Transfers from an application server on port 10000 keep stalling: 157 of 1,078 data segments (14.6%) were retransmitted in 18 seconds.
What the report found
"The fault lies in the network path: full-size segments to 192.168.88.246:10000 were retransmitted again and again while small packets got through — a possible MTU black hole."
Recommendation
Test the path MTU from the affected client, allow ICMP fragmentation-needed along the path, then capture again and re-run the analysis to confirm the fix.
ARP Spoofing & Traffic Interception
The Symptom
A host's internet traffic leaves through a device that is not the gateway — forged ARP replies redirect it, and nothing above Layer 2 shows it.
What the report found
"MITRE T1557.002 confirmed: a device with MAC 00:25:b3:bf:91:ee (172.16.0.105) claimed gateway 172.16.0.1 and received the internet traffic of 172.16.0.107, including 12 session tokens in cleartext HTTP (T1539)."
Recommendation
Isolate the switch port of 00:25:b3:bf:91:ee, flush the ARP cache on the affected hosts, and turn on DHCP snooping and Dynamic ARP Inspection.
Cleartext Password Exposure
The Symptom
An internal host logs in to an external web server over plain HTTP — every password is readable to anyone on the network path.
What the report found
"MITRE T1040 confirmed: 192.168.0.4 sent HTTP Basic credentials in cleartext to 192.254.189.169 — 31 reusable passwords exposed, plus session data over cleartext HTTP (T1539)."
Recommendation
Reset the passwords of the exposed accounts, review their logins within 24 hours, and require encrypted logins on 192.254.189.169.
DNS Tunneling Detection
The Symptom
One host sends a steady stream of DNS queries with long encoded names to a single domain — data moving through port 53, which firewalls usually allow.
What the report found
"MITRE T1071.004 confirmed: 10.0.2.30 tunnelled data through pirate.sea, encoded in the query names and carried back in the answers, for 24 seconds."
Recommendation
Isolate 10.0.2.30 if the tunnel is not approved, block pirate.sea on internal resolvers, and allow outbound DNS only from approved resolvers.
PCI DSS & NIST Controls Review
The Symptom
A TLS server in a cardholder-data environment answers a Heartbleed probe with 16,384 bytes of its memory and still negotiates TLS older than 1.2.
What the report found
"Critical: Heartbleed probes (CVE-2014-0160, MITRE T1190) from 192.168.11.1 against 192.168.11.128, plus deprecated TLS — 23 controls to review across PCI DSS v4.0.1, NIST 800-53, ISO 27001 and CIS, including PCI DSS 4.2.1 and 6.3."
Recommendation
Take the vulnerable TLS service offline, upgrade OpenSSL and restart its processes, search logs for further heartbeat probes, and file the controls table as audit evidence.
Malware Exfiltration & C2 Credential Recovery
The Symptom
Unencrypted outbound FTP session to an unknown external IP — a STOR command uploading a compressed archive with a hostname-based filename.
What the report found
"Infostealer confirmed: MITRE T1048.003 exfiltration via FTP port 21. Hardcoded drop-server credentials (USER/PASS) extracted from the unencrypted session — MITRE T1040."
Recommendation
Block the C2 IP at the perimeter firewall, reset the credentials stored on the infected host and report the drop server to its hosting provider.
PhantomStealer C2 Tunnels & Network Anomalies
The Symptom
Periodic HTTP beaconing every 10 seconds from a single host, combined with DNS congestion at 265ms latency and TCP Zero Window events masking the root cause.
What the report found
"PhantomStealer confirmed: MITRE T1071.001 C2 tunnel to 185.27.134.154. Secondary SMTP exfiltration on port 587 (T1048.003) identified as a parallel data channel."
Recommendation
Block the C2 IP immediately. Audit outbound SMTP for exfiltration traces and flush DNS cache on affected hosts to stop ongoing beaconing.
Seen enough? Try it on your own traffic.
Upload a PCAP or PCAPNG up to 20 MB: the free summary takes about two minutes, and the full PDF report is $9. Uploads without an account are deleted 24 hours after upload.
Every security finding above is mapped to MITRE ATT&CK. See all 68 techniques PcapAI detects →
No installation · no account · what every report contains