Looking at the content of the pcap, most of the traffic is HTTP, HTTPS and the rest is noise. However one packet that doesn’t seem right is UDP from 127.0.0.1 to 127.0.0.1.
We know that this is not normal traffic but instead it’s crafted.
$ tcpdump -nnr sharkfin.pcap -As0 udp and host 127.0.0.1
reading from file sharkfin.pcap, link-type EN10MB (Ethernet)
14:59:54.303760 IP 127.0.0.1.32769 > 127.0.0.1.139: UDP, length 44
E..H..@.@.<..............4..696e666f7365635f666c616769735f736e6966666564
$
This doesn’t look like NETBIOS traffic at all, right ? Let’s convert from hex to ascii.
