Skunkworks AcademyPractical labs

LAB-NET-201 · Network analysis

Wireshark PCAP investigation - read before you conclude.

A packet timeline is evidence, not a story by itself. Learn how to find the DNS question, TCP conversation and normal close in a compact synthetic trace - then write what the trace does and does not show.

Begin the lab What you will learn

Estimated time: 60 minutes · Stored synthetic trace · No live capture, scanning or target interaction

Lab summary

Make every finding reproducible, proportionate and within scope.

  • 01
    Read the timeline.
    Identify a DNS lookup, three-way TCP handshake, encrypted-session initiation and ordinary connection close.
  • 02
    Use filters as questions.
    A display filter narrows the current view; it does not change the capture or prove what a user intended.
  • 03
    Write a defensible note.
    Record packet/time range, filter, observation and the authorised source of corroboration.

Training boundary: no live capture or active network work

The trace below is fictional and stored as text. This lab does not provide a PCAP, touch a network interface, send a packet, scan a host or authorise any traffic interception. Use packet-analysis tools only with documented authority and privacy controls.

Module 1

Start with scope, authority and a question.

Good packet review begins before a filter is typed. You should know who authorised the collection, what systems/time period are in scope, and the question you are trying to answer.

Capture versus display

Display filters change the view, not the stored evidence.

They help a reviewer focus on relevant packets. They are not a network control and do not modify packet contents.

Observation versus conclusion

A connection is not an attribution.

Packet data can support a factual observation such as “a client attempted a TLS session at this time.” It does not establish intent alone.

Corroboration

Ask an authorised owner for related logs.

Endpoint, proxy, asset and change records may explain a session. Do not turn a browser workbook into a live investigation.

Evidence note template: “Question: [what am I checking?]. Filter: [what narrowed the view?]. Observation: [what exact packet/time shows it?]. Limit: [what cannot be concluded?]. Next: [authorised source of corroboration].”
Which statement best describes a responsible PCAP-review workflow?

Module 2

Read a compact packet timeline.

This fictional sequence starts with a name lookup and shows a normal TCP setup, an encrypted-session start and a close. The values are documentation-only training data.

Synthetic packet summary

Find the conversation without inventing a verdict.

Stored text only
No.TimeSourceDestinationProtocolInfo
1410:03:14.11210.20.8.7410.20.8.53DNSStandard query A telemetry.training.example
1510:03:14.12610.20.8.5310.20.8.74DNSResponse A 198.51.100.44
1610:03:14.13310.20.8.74:51142198.51.100.44:443TCPSYN
1710:03:14.151198.51.100.44:44310.20.8.74:51142TCPSYN, ACK
1810:03:14.15210.20.8.74:51142198.51.100.44:443TCPACK
1910:03:14.15910.20.8.74198.51.100.44TLSClient Hello
2410:03:16.90010.20.8.74:51142198.51.100.44:443TCPFIN, ACK
2510:03:16.918198.51.100.44:44310.20.8.74:51142TCPACK
Client: 10.20.8.74Resolver: 10.20.8.53Destination: 198.51.100.44Documentation-only range
Which packets establish the TCP connection in this trace?

Module 3

Turn the case into a reproducible review question.

The security team wants to understand the small client conversation, not to label a destination or reach it. A targeted display filter helps focus the stored evidence before an authorised owner correlates more data.

Evidence-led filter exercise

Record how you narrowed the view and what remains unknown.

No live investigation

Review question

“What DNS and TCP packets belong to the fictional client 10.20.8.74 during the 10:03 window?”

A suitable display-filter concept is:

ip.addr == 10.20.8.74 and (dns or tcp.port == 443)

It narrows the current view to the client and the protocols relevant to the stated question. It does not prove why the session happened or whether the destination is harmful.

What is the best next action after identifying this conversation in the synthetic trace?

Module 4

Knowledge check

Answer all seven questions. A score of six or higher marks this browser-only lab as complete.

The assessment checks evidence-led packet-review reasoning. It does not grant permission for live packet capture or network action.

1. Which sequence represents the ordinary TCP three-way handshake?

2. What does the DNS response in the trace establish?

3. What does a Wireshark display filter do?

4. Which detail belongs in a defensible packet-review note?

5. What is a connection to a destination address best described as before context is added?

6. After making a factual observation, what is the appropriate follow-up in a governed environment?

7. What kind of traffic is available in this lab?

Evidence of learning

Create your local completion record.

After completing the checkpoints and assessment, record your name for a printable personal learning record. It is not a forensic report, a verified credential or authorisation for packet capture.

Skunkworks Academy · Labs

Wireshark PCAP Investigation

This confirms that the learner completed the browser-only learning activities on .

Lab code: LAB-NET-201 · 60 minutes · Synthetic packet timeline

Local learning record only. It does not verify identity, practical competence, packet-capture authority or an incident finding.