When a host is infected or otherwise compromised, security professionals need to quickly review packet captures (pcaps) of suspicious network traffic to identify affected hosts and users.

https://unit42.paloaltonetworks.com/using-wireshark-identifying-hosts-and-users/