Lab — Wireshark Packet Analysis
Capture and inspect your own traffic with Wireshark—ethically
Packets are evidence — only if they are yours to collect
Wireshark turns a NIC into a microscope: DNS questions, TLS handshakes, HTTP request lines. That microscope does not know ethics. It will as happily record a roommate's session on café Wi-Fi as it will record your loopback curl. The difference is authorization, not a checkbox in the GUI. This lab captures only your own interface or localhost while you generate the traffic: nslookup/getent and curl that you run. Never capture a shared hotspot, a dorm switch, or anyone else's packets. If you cannot say "this frame left or entered my lab VM because I caused it," stop the capture.
1. What you are trying to see — DNS, HTTP, TLS
A name lookup is usually UDP/53 (sometimes TCP/53 for large answers). In Wireshark the display filter dns shows queries and responses. Click a response: query name, type (A/AAAA), and the address in the answer section. That is the phone book from the last lessons, as bytes. HTTP on port 80 shows as protocol HTTP: method, path, Host, maybe cookies — readable because nothing encrypted the application bytes. HTTPS shows as TLS (or QUIC for HTTP/3): Client Hello, certificates, then Application Data you cannot read as HTML. The lesson is contrast: same curl family, two different visibilities. You are not writing decryptors. You are confirming the model.
Loopback (lo, interface "Loopback" / Adapter for loopback) is the safest classroom: traffic from your process to 127.0.0.1 never left the machine. Capturing your own VM's NAT/bridged NIC is also in scope if you only generate your own DNS/HTTP/HTTPS to example.com. Capturing "the Wi-Fi" in a café because lots of packets appear is how students accidentally commit a crime. Promiscuous mode is not extra credit.
2. Wrong vs right: the café capture
Worked failure mode — confusing "I can see packets" with "I may see packets." Scope is your NIC, your VM, your localhost.
- Wrong: You open Wireshark on public Wi-Fi, click the café adapter, and scroll other people's DNS names and HTTP. You capture a roommate's hotspot "because they said they did not mind" without a clear, informed yes — still a terrible habit and often still against policy. You keep a pcap of a shared network and upload it to a public gist.
- Right: Select loopback or the VM's own interface. Start capture. In another terminal, nslookup example.com and curl -I https://example.com (and optionally curl -I http://example.com). Filter dns, then tls, then http. Stop. Save notes under $HOME/cyberlium-lab. If the GUI is missing, tcpdump -i lo -c 20 on your own VM, not -i wlan0 in a coffee shop.
3. Hands-on: generate your own packets, then filter
Install Wireshark only on a machine you administer. Pick the interface that will actually carry YOUR test: lo for localhost; the VM NIC if you are querying example.com through NAT. Start capture, generate traffic, apply display filters (they do not delete the file; they hide rows). Stop capture before you wander onto other networks. Without a GUI, tcpdump on lo with a packet count is the fallback — still your VM, still a cap, still not a LAN tap.
Command guide
Own-machine capture — Wireshark GUI or tcpdump on lo
--- Terminal A: generate ONLY your traffic (after capture is running) ---
Command — copy this
nslookup example.com getent hosts example.com curl -I http://example.com curl -I https://example.com
Optional localhost HTTP so loopback captures something obvious (stop with Ctrl+C when finished)
Command — copy this
python3 -m http.server 8000 --bind 127.0.0.1 & sleep 1 curl -I http://127.0.0.1:8000/ kill %1 2>/dev/null || true
--- Wireshark display filters (paste one at a time in the filter bar) --- dns http tls dns or http or tls
--- If Wireshark GUI is unavailable: tcpdump on YOUR loopback only --- Requires permission to capture on lo (your VM). -c 20 stops after 20 packets.
Command — copy this
mkdir -p "$HOME/cyberlium-lab" sudo tcpdump -i lo -c 20 -n -w "$HOME/cyberlium-lab/lo-20.pcap"
Optional command
Read a text summary (still your file):
Command — copy this
tcpdump -nn -r "$HOME/cyberlium-lab/lo-20.pcap" | head -n 40 chmod 600 "$HOME/cyberlium-lab/lo-20.pcap" 2>/dev/null || true
Notes
Command — copy this
{
echo 'Interface used: lo OR my VM NIC (circle one)'
echo 'DNS query name: example.com'
echo 'HTTP cleartext visible? (yes/no)'
echo 'TLS Application Data readable as HTML? (should be no)'
} >> "$HOME/cyberlium-lab/wireshark-notes.txt"
chmod 600 "$HOME/cyberlium-lab/wireshark-notes.txt"NEVER: tcpdump/wireshark on café Wi-Fi, dorm uplink, or a roommate's packets NEVER: capture without a packet limit on a shared interface "to see what happens" NEVER: share pcaps that might contain other people's names, cookies, or mail
Mission: one DNS answer and one TLS (or HTTP) view, own traffic only
Capture on loopback or your own NIC while you nslookup/getent example.com and curl -I https://example.com (and http if you want the cleartext contrast). Apply filters dns, tls, and http. In $HOME/cyberlium-lab/wireshark-notes.txt write: query name + answered IP, whether HTTP headers were readable, whether TLS payload was HTML. If Wireshark is missing: sudo tcpdump -i lo -c 20 on your VM. Never capture other people's networks.
Stuck? Ask Cyberlium AI Mentor
If the packet list is empty or everything is "QUIC" instead of TLS, ask Cyberlium AI Mentor for a hint — not a capture of the LAN. Try: "Hint only: I curled https://example.com but the dns filter is empty — could the OS have cached the name, and what should I generate besides curl?"
You practiced the only packet lab that is always in scope: your resolver query, your curl, your loopback or your NIC, filters dns / tls / http, and a hard stop before other people's networks. Next — Quiz — Protocols — APPLY DNS, HTTP/HTTPS, FTP/SSH/mail, and this capture ethic, then Module 4 starts with TCP vs UDP Explained.
APPLY: You need a pcap for class. Which capture is the ethical default?
APPLY: Filter tls shows Client Hello and Application Data; filter http is empty for curl -I https://example.com. What should you conclude?
APPLY: True or False: Display filters dns, tls, and http hide rows in the view; they are not a license to keep a pcap of other people's devices "as long as you filtered."