Skip to main content

Lab 1.2: Observing Network Traffic with Wireshark

Learning Objectives​

By the end of this lab, you will be able to:

  • Install and configure Wireshark
  • Capture network traffic in real-time
  • Filter packets to isolate what interests you
  • Understand basic network protocols (TCP, UDP, DNS, HTTP)
  • Analyze a simple network communication

Estimated Duration​

45 minutes

Prerequisites​

  • Lab 1.1 completed
  • Administrator rights on your computer
  • Active Internet connection

Professional Context​

Wireshark is the world's most widely used network traffic analysis tool by IT professionals. It allows you to:

  • Diagnose complex network issues
  • Analyze network performance
  • Understand application behavior
  • Detect security anomalies
  • Validate network configuration

Part 1: Installing Wireshark​

Step 1.1: Download​

  1. Visit: https://www.wireshark.org/download.html
  2. Download the Windows Installer version (64-bit)
  3. Run the installation file

Step 1.2: Installation​

Recommended installation settings:

  • Accept all default options
  • IMPORTANT: Install Npcap when prompted (necessary for packet capture)
  • Check the option "Install Npcap in WinPcap API-compatible mode" if prompted

Step 1.3: First Launch​

  1. Launch Wireshark (as administrator if prompted)
  2. You should see the list of your network interfaces
  3. Identify the interface with traffic (graph with spikes)

Questions:

  1. How many network interfaces are listed?
  2. Which one shows activity?

Part 2: First Capture​

Step 2.1: Start a Capture​

  1. Double-click on your active network interface (usually Ethernet or Wi-Fi)
  2. Wireshark immediately starts capturing packets
  3. You will see lines scrolling quickly

Observe:

  • Each line = a network packet
  • Different colors = different types of protocols
  • The columns show: Time, Source, Destination, Protocol, Info

Step 2.2: Generate Simple Traffic​

Keep Wireshark open and in the command prompt:

Execute:

ping google.com -n 4

In Wireshark:

  • You should see ICMP packets appear
  • Look for lines with "Echo (ping) request" and "Echo (ping) reply"

Step 2.3: Stop the Capture​

Click the red square (Stop) button in the toolbar.

Questions: 3. How many packets did you capture in total? 4. Can you identify the 4 pings you sent?

Part 3: Packet Filtering​

You probably captured hundreds or thousands of packets. Filters allow you to see only what interests you.

Step 3.1: ICMP (Ping) Filter​

In the filter bar (at the top), type:

icmp

Press Enter. Now you only see the ping packets!

Observe:

  • The requests (request) from your computer to google.com
  • The replies (reply) from google.com to you

Step 3.2: Filter by IP Address​

To see all traffic to/from a specific IP address:

ip.addr == 8.8.8.8

(Replace with the IP of google.com found in your capture)

Step 3.3: Clear a Filter​

Click the X to the right of the filter bar to see all packets again.

Part 4: DNS Capture and Analysis​

DNS translates domain names (google.com) into IP addresses.

Step 4.1: New DNS Capture​

  1. Clear the current capture: File → Close
  2. Start a new capture
  3. Immediately apply the filter: dns

Step 4.2: Generate DNS Traffic​

In the command prompt:

Execute:

nslookup facebook.com
nslookup youtube.com
nslookup wikipedia.org

Step 4.3: Analyze DNS Requests​

In Wireshark, select a "Standard query" DNS packet

In the bottom panel, expand:

  • Domain Name System (query)
    • Queries
      • Look at the "Name" requested

Select now a "Standard query response" packet

Expand:

  • Domain Name System (response)
    • Answers
      • You will see the returned IP address!

Questions: 5. What is the IP address of facebook.com? 6. What DNS server is your computer querying? (look at the Destination column) 7. How long did the DNS request take? (look at the Time column)

Part 5: HTTP Capture (Web Traffic)​

Step 5.1: Setup​

  1. New capture
  2. Filter: http

Step 5.2: Generate HTTP Traffic​

IMPORTANT: You must visit a site in HTTP (non-secure) to see the content.

Visit in your browser:

Step 5.3: Analyze an HTTP Request​

Select a "GET" line (HTTP request)

In the detailed panel, expand:

  • Hypertext Transfer Protocol
    • You will see the complete request
    • The headers (User-Agent, Host, etc.)

Questions: 8. What is your browser's User-Agent? 9. What information is visible in clear text in the HTTP request? 10. Why is HTTPS more secure? (hint: repeat with https://google.com and see the difference)

Part 6: Analyzing a Complete Communication​

Step 6.1: TCP Three-Way Handshake​

The TCP protocol establishes a connection before transmitting data.

  1. New capture with filter: tcp
  2. Visit: http://example.com
  3. Stop the capture

Look for the first 3 packets to the server (port 80):

  • Packet 1: [SYN] - Your computer requests a connection
  • Packet 2: [SYN, ACK] - The server accepts
  • Packet 3: [ACK] - Your computer confirms

Questions: 11. Can you find the three-way handshake in your capture? 12. What are the sequence (Seq) and acknowledgment (Ack) numbers?

Step 6.2: Follow TCP Stream​

To see the entire conversation:

  1. Right-click on an HTTP packet
  2. Follow → TCP Stream
  3. A new window opens with the entire conversation in clear text!

Observe:

  • In red: What you sent
  • In blue: What the server replied
  • All the HTML content is visible!

Part 7: Practical Exercises​

Exercise 7.1: HTTP vs HTTPS Comparison​

Task:

  1. Capture traffic to http://neverssl.com
  2. Capture traffic to https://google.com
  3. Try to "Follow TCP Stream" on both

Question: 13. What can you see in HTTP that you cannot see in HTTPS?

Exercise 7.2: Protocol Identification​

Visit different sites and identify the protocols used:

Sites to test:

  • https://youtube.com (look for QUIC or HTTP/2 protocols)
  • Launch a Windows update (Microsoft protocols)
  • Open Discord or Teams (WebRTC)

Questions: 14. What new protocols did you discover? 15. How many TCP connections are established when you visit youtube.com?

Exercise 7.3: Problem Diagnosis​

Simulate a network problem:

  1. Start a capture
  2. Ping an address that does not exist: ping 1.2.3.4 -n 2
  3. Analyze the capture

Questions: 16. Do you see any ICMP "Destination unreachable" packets? 17. Who sends these messages? (look at the Source column)

Part 8: Network Statistics​

Wireshark offers powerful analysis tools.

Step 8.1: Protocol Hierarchy​

Menu: Statistics → Protocol Hierarchy

This shows the breakdown of all captured protocols.

Questions: 18. Which protocol represents the largest percentage of your traffic? 19. What percentage is encrypted traffic (TLS)?

Step 8.2: Conversations​

Menu: Statistics → Conversations

IPv4 tab: Shows all conversations between IP addresses.

Questions: 20. With which IP address did you exchange the most data? 21. How many different conversations did you establish?

Step 8.3: Endpoints​

Menu: Statistics → Endpoints

Lists all IP addresses that communicated.

Deliverables​

To submit:

  1. Wireshark capture file (.pcapng) containing:

    • ICMP (ping) packets
    • DNS requests
    • HTTP traffic

  2. Answer document (Word/PDF) with:

    • Answers to the 21 questions
    • 3 screenshots:
      • Capture with ICMP filter
      • DNS request capture with details
      • "Follow TCP Stream" of an HTTP request

  3. Comparative analysis HTTP vs HTTPS (1 page):

    • What you can see in HTTP
    • What is hidden in HTTPS
    • Why it is important for security

Evaluation Criteria​

CriterionPoints
Capture file containing all requested traffic types25%
Answers to questions (understanding of protocols)35%
Relevant and annotated screenshots20%
HTTP/HTTPS comparative analysis15%
Quality of documentation5%

Reference Wireshark Filters​

FilterDescriptionExample
icmpAll ping packetsicmp
dnsAll DNS requestsdns
httpUnencrypted web traffichttp
tcpAll TCP packetstcp
udpAll UDP packetsudp
ip.addr == XTraffic to/from an IPip.addr == 8.8.8.8
tcp.port == XTraffic on a TCP porttcp.port == 80
ip.src == XPackets from an IPip.src == 192.168.1.1
ip.dst == XPackets to an IPip.dst == 8.8.8.8
http.request.method == "GET"HTTP GET requestshttp.request.method == "GET"
dns.qry.name contains "google"DNS requests containing "google"dns.qry.name contains "google"

Useful Keyboard Shortcuts​

ShortcutAction
Ctrl + EStart/Stop capture
Ctrl + KCapture options
Ctrl + WClose capture
Ctrl + FFind a packet
Ctrl + GGo to packet N
Ctrl + RReload file

Troubleshooting​

Problem: "Couldn't run /usr/bin/dumpcap"​

Solution: Wireshark does not have the necessary permissions.

  • Relaunch Wireshark as administrator (right-click → Run as administrator)

Problem: No interface appears​

Solution: Npcap is not installed correctly.

  • Reinstall Wireshark and ensure Npcap is installed

Problem: "The capture session could not be initiated"​

Solution:

  • Another application might be using the network interface
  • Close VPNs and other network tools
  • Restart your computer

Problem: Too many packets, hard to see what interests me​

Solution:

  • Use filters!
  • Stop applications generating traffic (updates, cloud sync, etc.)
  • Capture only while generating the desired traffic

Going Further (Optional)​

Challenge 1: Identify an Application​

Open an application (Discord, Spotify, Steam) and identify:

  • The servers it communicates with
  • The protocols used
  • The amount of data exchanged

Challenge 2: Performance Analysis​

Measure the time required for:

  • DNS resolution
  • TCP connection establishment
  • Full web page loading

Challenge 3: Exotic Protocols​

Find and document 3 protocols you did not know before this lab.

Additional Resources​

Next Steps​

In the next lab, you will learn to:

  • Inventory your Windows system in depth
  • Identify running processes and services
  • Document your system's security configuration

Important Notes​

Ethics and Legality:

Wireshark is a powerful tool that can capture sensitive information. The following rules apply:

  1. Capture only:

    • Your own traffic
    • On networks you own or administer
    • On the provided lab environment

  2. NEVER capture:

    • Other people's traffic without their explicit consent
    • On public networks (café, school, company) without written authorization
    • With the intent to intercept passwords or confidential information

  3. Professional responsibility:

    • These skills are taught for legitimate troubleshooting and analysis
    • Misuse can lead to severe legal consequences
    • Respect others' privacy and intellectual property

When in doubt, always ask for permission before capturing network traffic.