Wireshark Tutorials

Capture a bounded local HTTP exchange, read a valid pcap, and connect packet endpoints with request and response content.

Compare HTTP response intervals and gaps between requests in Wireshark to locate two long waits.

Use Wireshark to pair repeated HTTP requests and export one complete event-page conversation.

Use decrypted HTTPS messages to distinguish a refused booking from its retry and export complete evidence.

Capture an authorized HTTPS visit in Wireshark and reopen it with its own TLS session secrets.

In this lab, you will go beyond network packet headers and learn how to inspect the actual payload data using tcpdump. You will utilize hexadecimal and ASCII output formatting flags to manually read and extract unencrypted application-layer traffic.

In this lab, you will write content-matching Snort rules capable of detecting application-layer attacks. You will analyze a simulated SQL Injection attack payload and craft a precise Snort rule to inspect HTTP traffic and alert whenever that malicious string is detected.

In this lab, you will learn the fundamentals of network traffic analysis using the command-line packet analyzer tcpdump on Linux. You will practice identifying network interfaces, capturing live raw traffic, and managing capture length to understand the basic flow of data across a network.

In this lab, you will explore tshark, the powerful command-line counterpart to Wireshark. You will learn how to capture traffic and apply display filters that inherently understand protocol structures like HTTP and DNS.

In this lab, you will learn how to reconstruct fragmented network conversations using tshark. By following complete TCP streams, you will stitch packets back together and view the entire interaction.

In this lab, you will learn the core syntax and anatomy of custom Snort rules. You will write foundational rules defining Actions, Protocols, IP addresses, Ports, and Options to specifically detect and alert on targeted ICMP pings and anomalous TCP traffic patterns.

In this lab, you will be introduced to Snort, a leading Network Intrusion Detection System (NIDS). You will learn how to configure Snort, understand its directory structure, and run it in sniffer mode to observe live network traffic matching default rule sets.

Read local HTTP resources, interpret response status and headers, and save headers separately from page content.

In this lab, you will learn how to interpret the alerts generated by an Intrusion Detection System. You will trigger several custom Snort rules and analyze both the fast and full alert logs to understand the attacker's IP, the targeted service, and the specific packet payload that caused the alarm.

In this lab, you will learn essential digital forensics skills by saving live network traffic captures to PCAP files, reading them back for offline analysis using tcpdump, and applying filters to retroactively investigate network events.

In this lab, you will learn how to parse network traffic for automated analysis. You will customize tshark's output to extract specific protocol fields and format them into clean, comma-separated values (CSV).

In this lab, you will master Berkeley Packet Filters (BPF) to surgically isolate network traffic using tcpdump. You will learn how to write filters based on specific IP addresses, subnets, and ports.

In this lab, you will launch Wireshark and explore its interface. You'll learn how to navigate the various panels and customize the layout to suit your needs. This includes adjusting columns, filters, and display options for efficient network analysis.