CyberDefendersNetwork ForensicsEasyRetiredWireshark
Scenario: The security team detected a surge of suspicious network activity consistent with LLMNR (Link-Local Multicast Name Resolution) and NBT-NS (NetBIOS Name Service) poisoning — protocols that fall back to broadcast name resolution when DNS fails, and which a rogue host on the same segment can hijack to harvest NTLM credentials. The task: work purely from a packet capture to identify the rogue machine, every host it poisoned, and which account got compromised as a result.

How LLMNR/NBT-NS Poisoning Works

When a Windows host can't resolve a hostname via DNS, it falls back to broadcasting an LLMNR or NBT-NS query to the entire local subnet, hoping any machine that recognizes the name will answer. A rogue host running a tool like Responder simply answers every query it sees — including typos — claiming to be whatever was asked for. The victim, trusting the response, then authenticates directly to the attacker over SMB using NTLM, handing over a crackable (or relayable) authentication exchange. Statistics → Conversations → IPv4 is the fastest way to spot this pattern in a capture: one host doing unusually high 1-to-many chatter across many peers is the rogue machine.
Q1The attacker took advantage of a mistyped query from a legitimate machine. What was the specific mistyped query made by 192.168.232.162?
llmnr and ip.src == 192.168.232.162
The attacker took advantage of a mistyped query from a legitimate machine. What was the specific mistyped query made by 192.168.232.162?
The attacker took advantage of a mistyped query from a legitimate machine. What was the specific mistyped query made by 192.168.232.162?
Filtering to LLMNR traffic sourced from the victim shows a repeated standard query for a name that doesn't exist on the network — a simple typo of a real file share name, which is exactly the kind of query LLMNR poisoning depends on going unanswered by legitimate DNS.
answerfileshaare
Q2What is the IP address of the machine acting as the rogue entity?
ip.addr == 192.168.232.162
What is the IP address of the machine acting as the rogue entity?
Isolating all traffic to/from the suspect IP shows it responding to the mistyped LLMNR/MDNS query almost instantly with an A record — well before any legitimate DNS or WINS server would, and for a hostname that was never actually queried for it.
answer192.168.232.215
Q3What is the IP address of the second machine that received poisoned responses from the rogue machine?
ip.addr == 192.168.232.215
What is the IP address of the second machine that received poisoned responses from the rogue machine?
Pivoting to every conversation the rogue host is involved in reveals a second victim receiving the same poisoned LLMNR/MDNS responses, followed by an SMB session — the rogue machine wasn't a one-off, it answered for multiple hosts on the segment.
answer192.168.232.176
Q4What is the username of the account that the attacker compromised?
ip.addr == 192.168.232.215
What is the username of the account that the attacker compromised?
Following the SMB2 session setup between the second victim and the rogue machine shows an NTLMSSP_AUTH request carrying the authenticating username in the clear inside the protocol negotiation.
answerjanesmith
Q5What is the hostname of the machine that the attacker accessed via SMB?
ip.dst == 192.168.232.215 and smb2
Drilling into the SMB2 Negotiate Protocol Response's NTLMSSP challenge — GSS-API → negTokenTarg → NTLM Secure Service Provider → Target Info — surfaces the DNS computer name attribute for the machine the attacker actually reached.
answerACCOUNTINPC

IOC Summary

ItemValue
Rogue Machine IP192.168.232.215
Mistyped LLMNR Queryfileshaare (typo of a real share name)
First Poisoned Victim192.168.232.162
Second Poisoned Victim192.168.232.176
Compromised Accountjanesmith
Target Hostname (SMB)AccountingPC
Lessons learned: LLMNR/NBT-NS poisoning depends entirely on legacy fallback protocols that almost no modern network actually needs — disabling both via Group Policy (or SMB signing + NTLM restriction as a second layer) closes this attack path outright rather than just detecting it after the fact. In a capture, Statistics → Conversations is the fastest first move: a single host responding to broadcast name-resolution traffic across multiple unrelated peers is a near-certain rogue responder. NTLMSSP fields are worth memorizing — ntlmssp.auth.username and ntlmssp.challenge.target_name hand over the compromised account and target hostname respectively without needing to crack anything, since the protocol negotiation carries them in the clear.