Skip to content

Wireshark Hands-on Labs

Choose the route that fits your available time and computing resources. Use the Interactive Lab for a short guided packet-evidence exercise, or the Full Lab to capture traffic and reproduce the complete analysis workflow in an isolated VM.

Hands-on proof of concept

Capture it. Investigate it. Prove it.

Build an isolated Wireshark analysis environment, capture safe traffic, reproduce the documented PCAP investigation, and retain enough evidence for another analyst to validate your conclusion.

⏱ 2–3 hours core ◆ Guided beginner ✓ Evidence required
Start building
Self-hosted · Several hours

Wireshark Full Lab

Installation required

How this differs from the guided walkthrough

The guided journeys retain the detailed screenshots, filters, object-export steps, and expected hashes from the demonstrated exercise. This page asks you to build your own environment, preserve source integrity, produce evidence, and write a reproducible analyst conclusion.

Use an isolated, authorised environment

Capture traffic only where you have explicit permission. Treat every object exported from the Unit 42 PCAPs as live malware. Use a disposable VM, disable shared folders and unnecessary networking, take a snapshot first, and never execute an exported object.

Before you begin

You need: a computer with virtualisation enabled, administrator access, a disposable Windows or Linux VM with snapshot support, approximately 10 GB of free storage, and temporary internet access for authorised downloads.

How to use this lab

Complete one session at a time. Stop when a milestone does not match your result. Use the nearby recovery guidance before moving to malware-containing captures or adding an optional protocol.

Recommended first

Beginner Core Lab

Build one isolated analysis VM, capture harmless traffic, and investigate one HTTP PCAP. Complete this route before exporting from additional protocols.

Expected time: 2–3 hours across three sessions.

Optional extension

Complete Analysis Lab

After the core milestones pass, investigate SMB, SMTP, and FTP, reduce a PCAP with TShark, and ask another analyst to reproduce the result.

Expected time: one or more additional sessions.

  1. Session 1Build and snapshot
  2. Session 2Capture safe traffic
  3. Session 3Investigate and report

Objective

You are preparing evidence for a small SOC investigation. First prove that your capture workflow records traffic you generated. Then examine a supplied HTTP capture and determine what the packet evidence supports without opening or executing an exported object.

By the end of the Beginner Core Lab, you will be able to:

  • document a reproducible Wireshark analysis baseline;
  • capture and characterise safe traffic from an authorised lab;
  • distinguish capture filters from display filters;
  • identify endpoints, conversations, protocols, and relevant streams;
  • export one supported HTTP object without executing it;
  • calculate and compare SHA-256 hashes;
  • support a concise conclusion with packet-level evidence.

The complete extension adds SMB, SMTP, FTP, TShark reduction, and peer validation. Malware-object activities require the isolated analysis VM described above.

01

Activity 1: Build and baseline the environment

Download and build record

Before transferring files into the isolated lab, record the following:

Item Value to record
Validation date YYYY-MM-DD
Wireshark Exact version, installer/package filename, source URL, and checksum
Npcap on Windows Exact version and selected installation options
Analysis host Operating system release, architecture, memory, and storage
Unit 42 archive Source URL, retrieval date, archive filename, and SHA-256 checksum
Extracted PCAPs Filename, size, and SHA-256 checksum for each capture
Lab isolation Virtual network mode, disabled integrations, and clean snapshot name

Use the official Wireshark download page and the Unit 42 tutorial repository as the authoritative sources for this exercise.

Prepare the analysis VM

  1. Create or select a disposable Windows or Linux VM.
  2. Place it on an isolated virtual network.
  3. Disable shared folders, clipboard integration, drag-and-drop, and automatic attachment of removable media.
  4. Install Wireshark using the relevant installation procedure.
  5. Confirm that Wireshark and TShark report the recorded version.
  6. Confirm that Wireshark lists the expected interfaces.
  7. Create a clean snapshot named wireshark-clean-baseline.
Milestone 1Analysis VM readyWireshark and TShark start, the expected interfaces are visible, the build record is complete, and the clean snapshot can be restored.
If the build checkpoint does not pass

If no interface appears on Windows, repair or reinstall Npcap and restart Wireshark. If TShark is missing, rerun the installer and select its component. Do not import the supplied PCAPs until the snapshot and isolation controls are confirmed.

Expected result Wireshark and TShark start successfully, the expected interfaces are visible, the build record identifies every external artifact, and the clean VM snapshot can be restored.

02

Activity 2: Capture and investigate safe traffic

Use traffic generated by your own lab systems. Do not capture a production, shared, or third-party network. A capture filter decides which packets are recorded; excluded packets cannot be recovered. A display filter changes what you see after capture without deleting packets. Start this exercise without a capture filter.

  1. Select the active lab interface and start a capture without a capture filter.

  2. Record the current time, then generate one harmless ICMP exchange from the analysis VM to another authorised lab address:

    === "Windows"

    ```powershell
ping -n 4 <lab-ip>
```

    === "Linux"

    ```bash
ping -c 4 <lab-ip>
```

  3. Optionally generate a DNS lookup against your lab resolver or an HTTP request to a local test server. Record the command and target you used.

  4. Stop the capture and save it as authorised-baseline.pcapng.
  5. Record the capture's SHA-256 hash before analysis.
  6. Review Statistics → Capture File Properties and record the capture start, end, duration, packet count, and dropped-packet information.
  7. Review Statistics → Protocol Hierarchy, Endpoints, and Conversations.
  8. Apply icmp as a display filter. If you generated optional traffic, also try dns or http.request.
  9. Choose one echo-request packet and record its frame number, timestamp, source, destination, protocol, and why it matters.
  10. Clear the display filter and confirm that the other recorded packets return.
Milestone 2Known traffic explainedYou generated four authorised echo requests, found the corresponding packets with a display filter, and tied one frame back to the recorded test window.
If the expected packets are missing

Confirm that you selected the interface carrying the lab traffic and that no capture filter was active. On Windows, allow ICMP through the lab host's firewall or use authorised DNS traffic instead. Clear the display filter to distinguish an empty capture from a filter that matches nothing.

Expected result The saved capture has a recorded source hash, the protocol and endpoint summaries match the activity you generated, and at least one packet or stream supports an explainable observation.

03

Activity 3: Reproduce and extend the PCAP analysis

Beginner Core Lab: investigate one HTTP capture

  1. Inside the isolated VM, download and extract the Unit 42 archive by following Prepare the supplied PCAPs.
  2. Verify and record the archive hash and the hash of Wireshark-tutorial-extracting-objects-from-a-pcap-1-of-5.pcap before opening it.
  3. Open only PCAP 1 and apply the display filter http.request.
  4. Find the two requests to smart-fax[.]com. Record their frame numbers, timestamps, source, destination, methods, and requested paths.
  5. Use File → Export Objects → HTTP and export only Invoice&MSO-Request.doc. Save it inside the isolated VM and do not open it.
  6. Calculate its SHA-256 hash and compare it with the expected value in the HTTP procedure.
  7. Record whether the object is complete, whether its hash matches, and what the network evidence does and does not prove.
  8. If a field, object, or hash differs, record the difference instead of forcing the documented outcome.
Milestone 3One finding supportedYou traced an HTTP request to one exported object, preserved its hash, and wrote a bounded conclusion without executing the file.
If HTTP objects or hashes differ

Confirm that you opened PCAP 1, applied a display filter rather than a capture filter, and selected HTTP in Export Objects. An empty object list usually means the wrong capture or protocol was selected. A hash mismatch may indicate the wrong object or incomplete data; preserve the difference and do not open the file.

Expected result The two HTTP requests are identified, one supported object is exported without execution, its calculated hash and completeness are recorded, and any difference from the walkthrough is explained.

Optional extension: investigate SMB, SMTP, and FTP

Complete one protocol at a time using the PCAP analysis and object-export procedure:

Protocol Capture Starting point Evidence to retain
SMB PCAP 3 File → Export Objects → SMB Packet number, share path, completeness, filename, and SHA-256
SMTP PCAP 4 smtp.data.fragment Relevant frames and one message reviewed as text
FTP PCAP 5 ftp.request.command or (ftp-data and tcp.seq eq 1) Commands, transferred filenames, relevant streams, and hashes where supplied

Stop after each protocol and compare the result with its checkpoint. Export only what is needed, keep it inside the isolated VM, and never execute an object. Treat HTML and email as active content and review them as text.

Optional extension: reduce and verify a capture with TShark
  1. Choose one relevant host from a supplied PCAP.
  2. Use the TShark procedure to write matching packets to a new PCAP using -Y and -w.
  3. Run the inverse-filter verification command against the output PCAP.
  4. Open the output in Wireshark and confirm that it retains the evidence needed for your conclusion.
  5. Record the source PCAP hash, TShark command, output PCAP hash, packet count, and verification result.

Expected result The inverse filter returns no frame numbers, the reduced PCAP contains the required evidence, and another analyst can reproduce the output from your recorded command.

Write and validate the conclusion

Use this template for a short analyst note:

Question:
Source PCAP and SHA-256:
Relevant frames and timestamps:
Endpoints and protocol:
Display filters and commands:
Exported object and SHA-256:
Observed evidence:
Interpretation:
Limitations and uncertainty:
Confidence:
Recommended next step:

For the Beginner Core Lab, ask someone to trace the note back to the recorded frames and object hash. For the complete extension, ask another analyst to repeat the work from the clean snapshot. A matching result is stronger evidence than a screenshot alone.

Expected result Another analyst can trace your conclusion back to specific packets, reproduce the filters and commands, and distinguish observed facts from interpretation.

Full Lab evidence checklist

Retain only authorised evidence. Do not move malware objects out of the isolated analysis environment merely to complete this checklist.

This checklist defines completion of the VM-based Beginner Core Lab. If you completed the Interactive Lab, retain its downloaded evidence summary instead. Record optional protocol and TShark evidence separately if used.

0 of 8 recorded Mark each item after saving the evidence.
Optional extension evidence

If you completed the advanced route, also retain the selected SMB, SMTP, and FTP evidence; the exact TShark command; source and output hashes; packet count; inverse-filter result; and peer-validation notes. These items do not block completion of the Beginner Core Lab.

Clean up

  1. Close Wireshark, TShark, text editors, and any other analysis tools.
  2. Confirm that no exported document, executable, email, or HTML object was executed or opened outside the isolated workflow.
  3. Preserve authorised notes, hashes, commands, and required PCAP evidence in the approved case or lab location.
  4. Delete exported malware objects from any temporary transfer location.
  5. Revert the disposable VM to wireshark-clean-baseline, or securely dispose of the VM according to your lab procedure.
  6. Confirm that shared folders and clipboard integration remain disabled.
  7. Record who completed the cleanup and when.

Do not rely on ordinary deletion for an exposed host

If a suspicious object was executed or opened with active networking, stop the exercise and follow your incident-response process. Reverting the lab VM does not address exposure of a host or shared storage outside the VM.

Where to go next

Review PCAP analysisReturn to the detailed filters, screenshots, and expected hashes. Explore ZeekTurn network traffic into structured, searchable logs. Explore ZuiInvestigate Zeek data and packet-derived evidence interactively.
PreviousWireshark overview NextExplore Zeek