Lab 5 of 17 · By Michael Stout
In this lab
Read the steps, then try them in your lab environment.
Capture and analyze traffic with Wireshark
Chapter 3 lists packet capture and analysis among the core techniques for detecting malicious activity. This lab installs Wireshark, captures a slice of your own everyday traffic, and gets you comfortable reading what's actually on the wire.
Logs tell you what a system claims happened
A packet capture tells you what actually crossed the network — no agent to trust, no log format to interpret. That's why full packet capture sits at the bottom of most detection strategies: it's ground truth, even if it's the most expensive to store at scale. Wireshark is the tool almost every analyst learns this on first, and it's free.
Windows can't capture raw packets without a driver. Every Wireshark Windows installer bundles the latest stable release of Npcap, so you don't download it separately.
What you'll need
Windows 10 or 11, 64-bit (an Arm64 build is also available).
Administrator rights to install Npcap's capture driver; capturing live traffic afterward typically needs an admin session too.
Any active connection — Wi-Fi or Ethernet. You'll capture your own traffic, not anyone else's.
15–25 minutes.
Get the capture engine running
- Download it. Go to
wireshark.org/download.htmland get the Windows x64 installer. - Run the installer. Accept the defaults. When prompted, allow it to install Npcap — that's the driver that makes live capture possible.
- Confirm the version. Launch Wireshark and check Help → About Wireshark to confirm it installed correctly.
Look at your own traffic
- Pick an interface. On Wireshark's start screen, double-click your active Wi-Fi or Ethernet adapter — the one showing live traffic in its mini-graph.
- Generate some traffic. Open a browser and visit two or three ordinary sites while the capture runs.
- Stop and filter. Click the red stop-capture square, then type
http.requestordnsinto the display filter bar and press Enter. - Read one packet. Click a single row and expand the layers in the lower pane — Ethernet, then IP, then TCP, then the application layer. That's the whole conversation, in order.
Four filters worth learning
| Filter | What it shows |
|---|---|
dns | Every DNS query and response — useful for spotting beaconing to an unfamiliar domain. |
tcp.flags.syn==1 && tcp.flags.ack==0 | Outbound SYN packets only — the start of every new TCP connection your machine initiated. |
http.request | Plaintext HTTP requests — a reminder of how much still travels unencrypted. |
ip.addr == <an IP> | Everything to or from one address — right-click any packet's IP and choose “Apply as Filter” to build this without typing it. |
Capturing traffic on a network you don't own or administer, or that belongs to other people without consent, is a policy and, in many places, a legal problem — not just a lab exercise. Keep this on your own machine and your own connection.
Sources. Wireshark, download and release information, wireshark.org/download.html.