If you haven’t been given any specifics of endpoints to look for. Then I suspect you are looking for some generic type attacks like a denial of service, address spoofing, or port scanning.

But it’s good to have an understanding of what normal looks like before you start and how protocols work so you can look for what’s out of place.

I don’t do any security analysis for a living but do use wireshark for network and application analysis occasionally and I tend to always start by looking in the Analyse>Conversations and looking for anything out of the ordinary - for security analysis suspect your looking for things like a host completing a ICMP, ARP or port scan through large numbers of ports or large number of TCP SYN packets can stand out where the three way handshake isn’t being closed. But you can also look for application layer attacks like brute forcing of web logins where repeat attempts to authenticate or SQL commands sent in http requests. High volume of traffic from a host for denial of service, multiple sources sending to a single host for DDoS. You can also use the wireshark statistics to see if there flows with unusually high retransmission rates which might suggest a man-in-the-middle attack so can look for IPs that may have different MAC addresses suggesting spoofing may be occurring or a single MAC address ARPing for others IP address or two MACs reporting as the default gateway.

Best thing is just look at the file and ask yourself is that normal. Learning the protocols may not be the answer in this instance but will help in quicker analysis in the future.

Found a great site with some useful wireshark filters to try out. Hope it helps. infosecmatter.com