Alright, let's see what we're actually dealing with before we touch anything. First things first — run capinfos on the file and just... take a breath.
411,000 packets. 197 MB. Okay. That's not a small capture. Whatever happened on this network, it wasn't quiet. We've got a solid chunk of traffic to dig through, but at least now we know the scale of what we're working with before we start chasing ghosts.
**capinfos env_pcap.pcap**
Next, let's grab just the first 15 packets and see what the network even looks like at a glance. Is this a normal-looking environment? Who's talking to who?
Sure enough — ARP requests, IGMP reports, the usual boring stuff. But it confirms something important: 10.42.85.0/24 is our internal network. That's our turf. Anything outside that range is either a legitimate external server... or someone who shouldn't be here.
**tcpdump -nr env_pcap.pcap "host 10.42" -c15**
