Wireshark Packet Analysis – 30 Real-World Exercises

GitHub: github.com/wireshark/wireshark

Install & Start Capturing

# Ubuntu/Debian
sudo apt install wireshark

# macOS
brew install --cask wireshark

# Start Wireshark, select your interface (eth0 / wlan0 / Wi-Fi)
# Click the blue shark fin to start capturing
# Apply filters in the filter bar (green = valid, red = invalid)

30 Real-World Exercises

Exercise 1: Capture Your Own Traffic

Filter: http
# Visit any HTTP site, stop capture, apply filter
# Look at the GET request and 200 OK response

Exercise 2: Filter by IP Address

Filter: ip.addr == 8.8.8.8
# Shows all traffic to/from Google DNS

Exercise 3: Filter by Port

Filter: tcp.port == 443   # HTTPS traffic
Filter: udp.port == 53    # DNS queries

Exercise 4: Identify DNS Queries

Filter: dns
# See every domain your device resolves
# Look at "Questions" in packet details panel

Exercise 5: Detect Cleartext Passwords ⚠️

Filter: http.request.method == "POST"
# Expand HTTP → HTML Form URL Encoded Data
# Username/password visible in plaintext — why HTTPS matters!

Exercise 6: Analyse TCP Handshake

Filter: tcp.flags.syn == 1 && tcp.flags.ack == 0
# See SYN → SYN-ACK → ACK sequence
# Note sequence numbers and window sizes

Exercise 7: Detect ARP Spoofing (MITM Attack)

Filter: arp
# Look for: multiple MAC addresses claiming the same IP
# Or: gratuitous ARP (IP in both sender/target fields)
# One IP → two MACs = man-in-the-middle attack in progress

Exercise 8: Identify C2 Beacon Traffic

Filter: tcp && ip.dst != 192.168.1.0/24
# Look for: regular-interval connections to external IPs
# Connection every 60 seconds exactly = C2 beacon pattern

Exercise 9: Analyse TLS Handshake

Filter: tls.handshake.type == 1   # Client Hello
Filter: tls.handshake.type == 11  # Certificate
# Inspect Server Certificate → Common Name, Issuer, Validity

Exercise 10: Detect Port Scanning

Filter: tcp.flags.syn == 1 && tcp.flags.ack == 0
# Look for: one source IP hitting many different destination ports
Filter: tcp.flags.reset == 1
# Many RSTs from one destination = closed ports being scanned

Exercise 11: Extract Files from Traffic

Filter: http
# File → Export Objects → HTTP
# Select files to extract (images, PDFs, executables)

Exercise 12: Analyse DHCP Process

Filter: dhcp
# See: Discover → Offer → Request → Acknowledge
# Note assigned IP, gateway, DNS server, lease time

Exercise 13: Detect DNS Tunneling

Filter: dns
# Look for: abnormally long domain names (50+ characters)
# e.g., aGVsbG8gd29ybGQ.data.attacker.com
# Base64-encoded data embedded in DNS queries = DNS tunneling

Exercises 14–30 (Quick Reference)

Display Filters Cheat Sheet

tshark — Command-Line Wireshark

# Capture 100 packets on eth0
tshark -i eth0 -c 100

# Filter DNS only (live)
tshark -i eth0 -f "port 53"

# Save to pcap file
tshark -i eth0 -w capture.pcap

# Read a pcap and filter
tshark -r capture.pcap -Y "dns"

# Show HTTP GET requests
tshark -r capture.pcap -Y "http.request.method == GET"

# Extract field values
tshark -r capture.pcap -Y dns -T fields -e dns.qry.name

Practice PCAP Files

• 60+ Wireshark Exercises (GitHub)
• LabEx Wireshark Free Tutorials
• Wireshark Home Lab Setup
• TryHackMe — Wireshark rooms