PCAP Literacy
PCAP literacy from $DFIR_LAB practice captures — read frames, flows, and protocols without tapping unauthorized networks.
Visual · t26_pcap_literacy
PCAP = packet capture timeline. $DFIR_LAB practice only. Original Cyberlium.
Network traffic tells a story — learn to read PCAP from YOUR authorized lab evidence, not from a roommate's Wi-Fi.
Packet captures record network conversations during an incident or lab exercise: Ethernet, IP, TCP/UDP, DNS, HTTP/S, TLS handshakes. Analyst literacy opens $DFIR_LAB PCAP in Wireshark-class tools, follows TCP streams, identifies DNS queries, notes connection intervals at category level — without tapping production LANs or stranger devices without legal authority. Cyberlium teaches frame fields (Source, Destination, Protocol, Info) and flow correlation with UTC log timelines from Modules 1–5 — NOT sniffing employer networks without authorization, NOT MITM-ing public Wi-Fi, NOT replaying captures to attack live infrastructure. Chain of custody applies: hash PCAP at acquisition, document tool version, redact PII before share. chmod 600 under $HOME/cyberlium-lab.
1. PCAP basics
Frames list conversations; follow TCP stream for HTTP or beacon-like patterns at literacy level.
UTC timestamps align with disk, memory, and log artifacts — single timeline discipline.
Command guide
Try these commands — PCAP basics
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
tcpdump — https://www.tcpdump.org/ (packet capture literacy) RFC 3227 — https://www.rfc-editor.org/rfc/rfc3227 (network state is volatile) SANS DFIR — https://www.sans.org/cyber-security-skills/digital-forensics/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install tcpdump
Built-in (iproute2)
macOS: Use: netstat
Windows: Use Wireshark or install via WSL Use: netstat
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}tiny pcap on loopback only — YOUR machine, -c limits packets
Command — copy this
ss -tuln | head -10 tcpdump -i lo -c 5 -w "$LAB_DFIR/pcap/lo-lab.pcap" 2>/dev/null & sleep 1; ping -c 2 127.0.0.1 >/dev/null 2>&1; wait file "$LAB_DFIR/pcap/lo-lab.pcap" 2>/dev/null || echo 'tcpdump may need: sudo apt install tcpdump'
Primary tools to practice this lesson: tcpdump, ss. Reference sites: tcpdump (https://www.tcpdump.org/); RFC 3227 (https://www.rfc-editor.org/rfc/rfc3227); SANS DFIR (https://www.sans.org/cyber-security-skills/digital-forensics/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Reading without overclaiming
Document observed: five-tuple, protocol, byte count — inferred: 'possible C2 interval' only with label.
TLS hides payload; SNI and certificate metadata may still support correlation rows.
3. $DFIR_LAB boundary
PCAP from practice images, instructor synthetic captures, or authorized lab case only.
Refused: roommate traffic, employer LAN taps without scope, stranger device sniffing.
4. What you ship: PCAP literacy card
Frame field glossary + follow-stream steps + observed/inferred rule + $DFIR_LAB scope line.
5. What you record before the next lesson
PCAP literacy card path.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Capture packets on employer Wi-Fi without authorization to 'practice DFIR.'
- Right: PCAP literacy card from $DFIR_LAB capture. Next: Log Sources.
Mission: PCAP literacy card
1) Define five frame fields. 2) Write follow-TCP-stream steps. 3) One observed vs inferred row from lab PCAP. 4) Write NEVER unauthorized capture line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “PCAP UTC vs local time — which wins in timeline?”
APPLY: PCAP literacy on Cyberlium uses:
APPLY: True or False: Unauthorized network capture is course lab.
APPLY: PCAP rows should label:
Log Sources
Part of Digital Forensics (DFIR) with AI — Network and Logs.
EXIF Strings
Part of Digital Forensics (DFIR) with AI — Network and Logs.
Lab — Net Logs
Part of Digital Forensics (DFIR) with AI — Network and Logs.