Investigate Network Traffic with Wireshark

Capture and analyze live packets to identify TCP, DNS, and TLS traffic.

Introduction

30 Second Summary

Every time you open a website, send a message, or stream a video, your computer is sending and receiving thousands of invisible data packets across the network. If something goes wrong, or if someone is snooping, how would you even know?

In this project, you will capture live network traffic on your own machine using Wireshark, the same tool SOC analysts use daily. You will dissect packets across multiple protocols and produce a structured security findings document.

What You'll Build

A hands-on network traffic analysis lab where you capture, filter, and interpret real packets from your own machine to identify security-relevant patterns.

By the end of this project, you'll have:

  • A working Wireshark installation capturing live traffic on your Windows machine.
  • Analyzed real TCP three-way handshakes at the packet level, understanding SYN, SYN-ACK, and ACK.
  • A documented security analysis report identifying encrypted vs. plaintext traffic, DNS queries, and connection patterns from your own network.
  • Secret Mission: Detect a simulated SYN flood pattern using Wireshark I/O Graphs.

Are there any prerequisites?

You need a basic understanding of IP addresses and DNS (what they are, not how to analyze them at packet level). You also need a Windows 10 or 11 machine.

Install Wireshark and Verify Capture

Before you can investigate network traffic, you need a tool that lets you see every single packet your machine sends and receives. Wireshark is the industry-standard packet analyzer used by SOC analysts worldwide to examine live network activity at the deepest level.

In this step, you will install Wireshark on your Windows machine, confirm it can capture live packets, and learn the interface layout you will use throughout this project.

In this step, get ready to:
  • Install Wireshark and its packet capture driver (Npcap).
  • Verify live packet capture is working on your network interface.
  • Learn the three Wireshark panes and the Display Filter toolbar.
Download and install Wireshark

Wireshark requires a packet capture driver called Npcap to intercept network traffic on Windows. The Wireshark installer bundles Npcap, so you only need one download.

  • Press the Windows key to open your search bar.
  • Type Wireshark and check if it appears in the search results.
  • If Wireshark appears, open it.
  • Click Help in the menu bar.
  • Click About Wireshark to see your version number.

✔️ I see version 4.6 or higher

Your Wireshark installation is up to date. Skip ahead to the next substep where you will verify packet capture.

ⓧ I see an older version

You need to upgrade to version 4.6.6 for this project. The Wireshark installer can install the new version directly over the old one.

  • Close Wireshark if it is running.
  • Open your web browser and go to https://www.wireshark.org/download.html.
  • Click the Windows x64 Installer link under Stable Release 4.6.6.
  • Run the downloaded installer.
  • The installer will detect your older version and offer to remove it. Click Yes to let it uninstall the old version first.
  • Accept the license agreement and use the default settings for each screen.
  • When prompted about Npcap, allow it to install with the default options checked.
  • Click Finish to complete the installation.

Why allow the old version to be removed?

Wireshark does not support side-by-side installations. The installer removes the old version automatically and preserves your personal settings and preferences.

ⓧ Wireshark doesn't appear in search

You need to install Wireshark 4.6.6 fresh on your machine.

  • Open your web browser and go to https://www.wireshark.org/download.html.
  • Click the Windows x64 Installer link under Stable Release 4.6.6.
  • Run the downloaded installer.
  • Accept the license agreement and use the default settings for each screen.
  • When prompted about Npcap, allow it to install. Keep the default Npcap options checked.
  • Click Finish to complete the installation.

What is Npcap?

Npcap is the packet capture driver that lets Wireshark see network traffic on Windows. Without it, Wireshark cannot intercept any packets.

The Wireshark installer bundles Npcap 1.88 so you do not need to download it separately.

Installer won't run or shows an error?

Make sure you downloaded the Windows x64 Installer (not the portable version or the source code). If Windows SmartScreen blocks the installer, click More info then Run anyway.

help me troubleshoot the Wireshark installer on Windows

Verify Wireshark can capture traffic

Wireshark needs Administrator permissions to access your network interfaces for packet capture on Windows.

  • Press the Windows key and type Wireshark.
  • Right-click Wireshark in the search results and select Run as administrator.
  • If prompted by User Account Control, click Yes.

On the Welcome screen, you will see a list of network interfaces with small activity graphs (sparklines) next to them.

  • Look for the interface with the most activity. This is usually Wi-Fi or Ethernet depending on your connection type.
  • Double-click your active interface to start a capture.

You should immediately see packets flowing in the top pane. Each row is one packet captured from your network.

  • Let the capture run for about 5 seconds.
  • Click the red square Stop button in the toolbar to end the capture.

If you see captured packets listed in the top pane, your setup is working correctly.

No interfaces showing or no packets captured?

Make sure you launched Wireshark with Run as administrator. Without Administrator permissions, Wireshark cannot access your network interfaces on Windows.

If interfaces appear but show no activity, confirm you are connected to a network. Check your Wi-Fi or Ethernet connection in Windows Settings > Network & Internet.

help me fix Wireshark not capturing packets on Windows

Understand the Wireshark interface

Now that you have a capture with packets in it, take a moment to understand the three main areas of the Wireshark window.

  • Click on any packet in the top pane to see all three areas populate with data.
  • Packet List Pane (top): One row per captured packet showing the packet number, timestamp, source IP, destination IP, protocol, and a summary in the Info column.
  • Packet Details Pane (middle): An expandable protocol tree for the selected packet. This shows layers from lowest to highest (Ethernet > IP > TCP > Application).
  • Packet Bytes Pane (bottom): The raw hexadecimal and ASCII view of the selected packet's bytes.

What about the green bar at the top?

The bar below the main toolbar is the Display Filter toolbar. You will type filters here to narrow which packets are shown.

The bar turns green when a valid filter is entered and red when the filter has a syntax error. You will use this toolbar constantly throughout this project.

  • Try clicking on different packets in the Packet List to see the Details and Bytes panes update.
  • Expand one of the protocol layers (like Internet Protocol Version 4) in the Packet Details pane by clicking the arrow next to it.

You now know where every piece of information lives in Wireshark. You will use all three panes and the Display Filter toolbar throughout this project.

Your Wireshark installation is ready and you have confirmed it can capture live traffic. Next up, you will generate specific types of network traffic and use display filters to isolate and analyze each protocol.

Capture Traffic and Refresh Network Fundamentals

Your Wireshark installation is working and you've confirmed it can capture live traffic. Now it's time to generate real network traffic across multiple protocols and observe what your machine is actually sending on the wire.

In this step, you'll visit websites, run network commands, and watch the packets flow through Wireshark in real time. By the end, you'll be able to read DNS queries and IP header fields directly from captured packets.

In this step, get ready to:
  • Start a controlled capture session generating HTTP, HTTPS, ICMP, and DNS traffic.
  • Analyze DNS packets to see how domain resolution works at the packet level.
  • Read IP header fields to understand how packets are addressed and routed.
Start a controlled capture session

To analyze different protocols side by side, you need a capture that contains multiple traffic types. You'll generate HTTP, HTTPS, ICMP, and DNS traffic so you have real packets to dissect.

  • In Wireshark, start a new capture on your active interface by double-clicking it on the Welcome screen.
  • Open your web browser and visit http://example.com in the address bar.
  • Then visit https://google.com in the same browser.

Why these two sites?

http://example.com uses unencrypted HTTP, so its traffic is fully visible in Wireshark. https://google.com uses encrypted HTTPS, so its content is hidden. Visiting both gives you a clear comparison of plaintext vs. encrypted traffic.

  • Open Command Prompt by pressing the Windows key, typing cmd, and pressing Enter.
  • Generate ICMP traffic by running this command:
ping 8.8.8.8
  • Generate a DNS query by running this command:
nslookup example.com
  • Return to Wireshark and click the red square Stop button in the toolbar to end the capture.

You should see hundreds of packets listed in the Packet List pane, with various protocols shown in the Protocol column.

Not seeing any packets?

Make sure you selected the correct network interface on the Welcome screen. The interface with the most activity (shown by the small waveform graph) is usually Wi-Fi or Ethernet depending on your connection type.

Also confirm Wireshark is running as Administrator. Right-click the Wireshark icon and select Run as administrator if you didn't earlier.

help me troubleshoot why Wireshark isn't capturing packets on my Windows machine

Refresh DNS at the packet level

DNS translates domain names like example.com into IP addresses your machine can connect to. Now you'll see exactly what a DNS query and response look like on the wire.

  • In the Display Filter toolbar (the text field below the main toolbar), type dns and press Enter.
  • Find a DNS query packet in the Packet List pane. Look for a row where the Info column shows Standard query.
  • Click the query packet to select it.
  • In the Packet Details pane (middle section), expand Domain Name System (query) by clicking the arrow next to it.
  • Look for the domain name your machine asked to resolve (e.g., example.com).

What should I see in the query?

The Source IP is your machine's address. The Destination IP is your DNS server's address. The Destination port is 53, the standard port for DNS.

Inside the expanded DNS section, you'll see the query name field showing the exact domain your machine requested.

  • Find the matching DNS response packet. Look for a row where the Info column shows Standard query response.
  • Click the response packet and expand Domain Name System (response) in the Packet Details pane.
  • Observe the IP address the DNS server returned for example.com.
  • Clear the filter by clicking the X button next to the filter bar.

Why is this significant for security?

DNS queries travel in plaintext by default. Anyone on the same network can see which domains your machine is resolving. This is why SOC analysts monitor DNS logs for suspicious domain lookups.

Refresh IP addressing at the packet level

Every packet carries an IP header with addressing information that tells it where to go. You'll now inspect these header fields directly in a captured packet.

  • Click any packet in your capture.
  • In the Packet Details pane, expand Internet Protocol Version 4 by clicking the arrow next to it.

What are these IP header fields?

  • Source IP: the address of the machine that sent this packet (your machine for outbound traffic).
  • Destination IP: the address of the machine receiving this packet (the remote server).
  • TTL (Time to Live): a counter that decreases at each router hop, preventing packets from looping forever.
  • Protocol: identifies what's inside the IP packet. 6 = TCP, 17 = UDP, 1 = ICMP.
  • Now apply a filter to isolate traffic to one specific server. Type ip.addr == 8.8.8.8 in the Display Filter toolbar and press Enter.

You should see only ICMP packets (from your ping command) and possibly DNS packets exchanged between your machine and 8.8.8.8 (Google's public DNS server).

  • Click one of the ICMP packets and expand Internet Protocol Version 4 to confirm the Source and Destination IPs match your machine and 8.8.8.8.
  • Clear the filter by clicking the X button next to the filter bar.

Not seeing packets with the ip.addr filter?

Make sure you typed the filter exactly as shown, including the double equals sign (==). If the filter bar turns red, Wireshark is telling you the syntax is invalid.

If the filter bar is green but shows zero results, your ping command may not have run successfully. Check that you pressed Enter after typing the ping command in Command Prompt and saw reply messages.

help me troubleshoot why my Wireshark display filter isn't showing the packets I expected

You've now observed real DNS resolution and IP addressing at the packet level. Next up, you'll dive into the TCP three-way handshake and see exactly how your machine establishes connections.

Analyze the TCP Three-Way Handshake

In the last step, you refreshed your DNS and IP fundamentals by observing real packets on your network. Now it's time to explore how connections are actually established between your machine and remote servers.

Every web page visit begins with a three-packet exchange called the TCP three-way handshake. SOC analysts look for anomalies in this handshake as a primary indicator of denial-of-service attacks.

In this step, get ready to:
  • Isolate a single TCP conversation using display filters and Follow TCP Stream.
  • Inspect TCP header fields across all three handshake packets (SYN, SYN-ACK, ACK).
  • Use completeness filters to identify connection states in large captures.
Isolate a TCP connection

Your capture contains many TCP connections. To study a single handshake in detail, you need to filter down to one conversation.

  • Filter for SYN packets (the first packet of every new TCP connection) by typing this in the Display Filter toolbar and pressing Enter:
tcp.flags.syn == 1

What does this filter show?

This filter displays all packets where the SYN flag is set. That includes both SYN packets (your machine requesting a connection) and SYN-ACK packets (servers responding). These are the first two packets of every TCP connection in your capture.

  • Look at the Info column and find a SYN packet going to destination port 80 (this is the HTTP connection to example.com).
  • Right-click that packet and select Follow > TCP Stream.
  • A dialog box opens showing the reassembled stream content. Click Close to dismiss the dialog while keeping the stream filter applied.

What did Follow TCP Stream do?

Wireshark automatically applied a display filter that isolates only the packets belonging to this single TCP conversation. The Packet List pane now shows just the packets exchanged between your machine and the example.com server on port 80.

The first three packets in this filtered view are your three-way handshake.

What are the three handshake packets?

  • Packet 1 (SYN): Your machine sends a SYN flag to the server. Sequence number is 0 (relative). Your machine is saying "I want to connect."
  • Packet 2 (SYN-ACK): The server responds with SYN and ACK flags set. It acknowledges your SYN and sends its own SYN. The server is saying "I accept, and I want to connect too."
  • Packet 3 (ACK): Your machine sends an ACK flag. Sequence number is 1, Acknowledgment is 1. Your machine is saying "Confirmed. We are connected."

Don't see a SYN packet to port 80?

Make sure you visited http://example.com (not https) during your capture in the previous step. HTTPS connections go to port 443, not port 80.

If you cannot find any port 80 traffic, start a new capture, visit http://example.com in your browser, then stop the capture and try the filter again.

Help me find the SYN packet for port 80 in my capture.

Inspect TCP header fields

Now that you can see the three handshake packets, expand the TCP header for each one to understand what information is exchanged.

  • Click the SYN packet (the first packet in the stream).
  • In the Packet Details pane, expand Transmission Control Protocol.

You should see these fields for the SYN packet:

  • Source Port: your machine's randomly assigned ephemeral port (a high number like 52431).
  • Destination Port: 80 (HTTP).
  • Sequence Number: 0 (relative).
  • Flags: SYN is set (0x002).
  • Window Size: how much data your machine can receive at once.
  • Click the SYN-ACK packet (the second packet in the stream).
  • Expand Transmission Control Protocol again.

Notice these differences in the SYN-ACK packet:

  • The source and destination ports are swapped (the server is responding).
  • Acknowledgment Number: 1 (confirming receipt of your SYN).
  • Flags: SYN and ACK are both set (0x012).
  • Click the ACK packet (the third packet in the stream).
  • Expand Transmission Control Protocol and observe:
  • Sequence Number: 1.
  • Acknowledgment Number: 1.
  • Flags: only ACK is set (0x010).
  • After this packet, data transfer begins.

Why do the sequence numbers start at 0?

Wireshark displays relative sequence numbers by default to make them easier to read. The actual numbers are large random values, but Wireshark subtracts the initial sequence number so the conversation starts at 0.

Use the tcp.completeness filter

Wireshark can classify TCP conversations by their completeness state using bit flags. This is a powerful technique for quickly identifying connection behavior in large captures.

  • Clear the current filter by clicking the X button next to the Display Filter toolbar.
  • Find connections that contain only the three-way handshake by typing this filter and pressing Enter:
tcp.completeness == 7

What does the number 7 mean?

Wireshark uses bit values to represent TCP conversation states: SYN = 1, SYN-ACK = 2, ACK = 4, DATA = 8, FIN = 16, RST = 32. Adding these together tells Wireshark which states to match.

The value 7 equals 1 + 2 + 4 (SYN + SYN-ACK + ACK). This matches connections where only the three-way handshake occurred, with no data transfer captured afterward.

These are connections that were established but had no data transfer in your capture.

  • Now find complete conversations (handshake + data + proper close) by applying this filter:
tcp.completeness == 31

What does the number 31 mean?

The value 31 equals 1 + 2 + 4 + 8 + 16 (SYN + SYN-ACK + ACK + DATA + FIN). This matches conversations that completed the full lifecycle: handshake, data exchange, and graceful close.

The tcp.completeness filter is a powerful SOC tool for quickly identifying connection states in a large capture without inspecting packets one by one.

  • Clear the filter by clicking the X next to the Display Filter toolbar.

Seeing zero results for tcp.completeness?

The completeness filter requires Wireshark to have captured enough of the conversation to classify it. If your capture was very short, some conversations may not have reached the state you are filtering for.

Try tcp.completeness == 31 first. If you still see zero results, your capture may not contain any fully closed connections. The HTTP connection to example.com is the most likely to show as complete.

Help me understand why my tcp.completeness filter shows no results.

You can now identify and dissect the TCP three-way handshake at the packet level. Next up, you will analyze security-relevant protocols to compare encrypted and unencrypted traffic.

Analyze Security-Relevant Protocols

You now understand how TCP connections are established at the packet level. The three-way handshake reveals how machines negotiate communication.

The next question a SOC analyst asks is: what protocols are running over those connections, and are they secure? In this step, you will compare plaintext HTTP traffic against encrypted HTTPS traffic, analyze ICMP packets, and save your capture for future reference.

In this step, get ready to:
  • Compare HTTP plaintext traffic against HTTPS encrypted traffic to understand the security difference.
  • Identify ICMP Echo Request and Reply packets from your earlier ping.
  • Save your capture file and create reusable display filter bookmarks.
Compare HTTP vs. HTTPS traffic

When you visited http://example.com, your browser sent a request over port 80 with no encryption. When you visited https://google.com, your browser used TLS to encrypt the connection first. Let's see exactly what that means for someone watching your network.

  • In the Display Filter toolbar, type http and press Enter.
  • Find an HTTP GET request to example.com in the Packet List pane. Look for "GET / HTTP/1.1" in the Info column.
  • Click the packet to select it.
  • In the Packet Details pane (middle), expand Hypertext Transfer Protocol.

You can read the full URL, request headers, and response body in plaintext. Every detail of your request is visible to anyone on the network.

Why is HTTP a security risk?

Anyone on the same network (a coffee shop, an office, or an ISP) can see exactly what you requested and what the server sent back. This includes form data, cookies, and page content. This is why modern browsers warn you about HTTP sites.

  • Clear the current filter by clicking the X button next to the filter bar.
  • Type tls.handshake.type == 1 in the Display Filter toolbar and press Enter.
  • This shows TLS Client Hello packets. Find one going to google.com.
  • Click the packet and expand Transport Layer Security in the Packet Details pane.
  • Expand TLS 1.3 Record Layer, then Handshake Protocol: Client Hello.
  • Find the Server Name Indication (SNI) field. It shows which domain was requested (e.g., google.com).

You can see the domain name in the SNI field, but the actual page content is fully encrypted. This is what HTTPS protects.

What can an attacker still see with HTTPS?

Even with HTTPS, an attacker on your network can see WHICH sites you visit (via SNI and DNS queries). They just cannot see WHAT you do on those sites. The page content, form submissions, and responses are all encrypted by TLS.

Analyze ICMP traffic

ICMP is the protocol behind the ping command. SOC analysts watch for unusual ICMP patterns because attackers use it for reconnaissance and sometimes covert data channels.

  • Clear the current filter by clicking the X button next to the filter bar.
  • Type icmp in the Display Filter toolbar and press Enter.
  • Find the ping packets you generated earlier. You will see pairs of packets: Echo (ping) request and Echo (ping) reply.
  • Click an Echo request packet and expand Internet Control Message Protocol in the Packet Details pane.

You should see Type 8 for Echo requests (your machine asking "are you there?") and Type 0 for Echo replies (the server confirming "yes, I am").

Why do SOC analysts care about ICMP?

ICMP is used for legitimate network diagnostics, but it can be abused. Attackers use it for reconnaissance (mapping which hosts are alive on a network). Advanced attackers also use ICMP tunneling to hide data inside ping packets, bypassing firewalls that only inspect TCP and UDP.

Save your capture and create filter bookmarks

Your capture contains valuable training data. Saving it to a file lets you reopen it later without recapturing. You will also bookmark the filters you found most useful so you can apply them instantly in future sessions.

  • Clear the display filter by clicking the X button so all packets are visible again.
  • Click File in the top menu bar.
  • Click Save As.
  • Choose a location (your Desktop is fine) and name the file traffic_analysis.pcapng.
  • Click Save.

Why pcapng format?

Wireshark uses pcapng as the default save format. It is more flexible than the older pcap format and supports features like packet comments and multiple capture interfaces. Other tools like tcpdump can read the older pcap format, but pcapng is the modern standard.

Now create filter bookmarks so you can reuse your best filters without retyping them.

  • Type tcp.flags.syn == 1 && tcp.flags.ack == 0 in the Display Filter toolbar.
  • Click the + button to the right of the filter toolbar. This creates a filter button.
  • In the dialog that appears, set the label to SYN Only - New Connections and click OK.
  • Repeat for dns with the label DNS Queries.
  • Repeat for tls.handshake.type == 1 with the label TLS Client Hello.
  • Repeat for tcp.analysis.flags with the label TCP Problems.

You should now see four filter buttons below the Display Filter toolbar. Clicking any of them instantly applies that filter to your capture.

What is tcp.analysis.flags?

This filter highlights packets that Wireshark has flagged as problematic. It catches retransmissions, out-of-order packets, and other TCP issues. In a SOC environment, a spike in these flags often points to network congestion or an ongoing attack.

Don't see the filter buttons?

Make sure you clicked the + button (not the bookmark icon on the left side of the filter bar). The + button appears to the right of the Display Filter toolbar.

If the buttons do not appear after clicking OK, try resizing the Wireshark window wider. Filter buttons can be hidden if the window is too narrow.

help me find the + button for filter bookmarks in Wireshark

You can now distinguish encrypted from plaintext traffic and identify ICMP activity in a capture. Next up, you will document all your findings in a structured security analysis report.

Document Your Security Findings

You've captured traffic, dissected TCP handshakes, and identified encrypted vs. plaintext connections across your network. Now it's time to turn those observations into a structured security report.

In a real SOC, raw packet captures are only half the job. The other half is documenting your findings so other analysts can act on them. You'll create a markdown report that mirrors the format used in professional incident investigations.

In this step, get ready to:
  • Create a markdown analysis report with a professional structure.
  • Populate the report using Wireshark's built-in statistics.
  • Document a TCP three-way handshake in detail.
Create your analysis report

A security analysis report captures everything you observed during your investigation in one structured document. This format lets other analysts quickly understand what happened on the network without replaying the entire capture.

  • Switch back to VS Code or Cursor.
  • Create a new file called security_analysis_report.md.
  • Paste the following report template into the file:
# Network Traffic Analysis Report

## Date: 2026-06-19
## Analyst: [Your Name]
## Capture Duration: ~5 minutes
## Interface: Wi-Fi / Ethernet
## Tool: Wireshark 4.6.6

---

## TCP Connections Observed

- Total SYN packets (new connections initiated): [count]
- SYN-ACK responses received: [count]
- Complete connections (handshake + data + close): [count]
- Destination ports observed: 80 (HTTP), 443 (HTTPS), 53 (DNS)

## DNS Activity

- DNS queries made: example.com, google.com
- DNS server used: [your DNS server IP]
- Protocol: UDP port 53
- Security note: DNS queries are in plaintext, exposing visited domains to anyone on the network.

## Encryption Status

- Unencrypted HTTP connections: example.com (port 80)
- Encrypted HTTPS/TLS connections: google.com (port 443, TLS 1.3)
- Security concern: HTTP traffic to example.com exposes full request/response content in plaintext.

## ICMP Activity

- Ping target: 8.8.8.8 (Google Public DNS)
- Packets sent: 4 Echo Requests (Type 8)
- Packets received: 4 Echo Replies (Type 0)
- Response status: All successful

## Key Findings

1. All web browsing except example.com was encrypted via TLS 1.3
2. DNS queries are transmitted in plaintext, exposing visited domains to network observers
3. TCP handshakes completed successfully with no retransmissions observed
4. ICMP ping to 8.8.8.8 confirmed network connectivity with normal round-trip times

## Recommendations

- Avoid HTTP sites where possible; ensure HTTPS is used for any sensitive browsing
- Consider using encrypted DNS (DoH or DoT) to protect DNS queries from observation
- Monitor for unusual ICMP patterns that could indicate reconnaissance activity

What does this template cover?

The report is structured into the same sections a SOC analyst would use when filing an investigation report.

  • The header identifies who ran the analysis, when, and with what tool.
  • TCP Connections Observed summarizes how many connections your machine initiated and completed.
  • DNS Activity and Encryption Status highlight what was visible to network observers.
  • Key Findings and Recommendations are the actionable takeaways another analyst would read first.
  • Save security_analysis_report.md.
  • You should see the markdown headings rendered in your editor. The bracketed placeholders like [count] are what you'll fill in next using Wireshark's statistics.

File not saving?

Make sure the file extension is .md and not .txt. If your editor asks you to choose a save location, save it anywhere you can find it easily (your Desktop or project folder).

Help me create my security analysis report file.

Populate the report using Wireshark statistics

Your template has placeholder values that you need to fill in from your actual capture. Wireshark provides built-in statistics tools that make this quick.

  • Switch back to Wireshark and open your saved traffic_analysis.pcapng capture file.
  • For the SYN packet count: apply the filter tcp.flags.syn == 1 && tcp.flags.ack == 0 and read the "Displayed" count from the status bar at the bottom of the window.
  • For the SYN-ACK count: apply the filter tcp.flags.syn == 1 && tcp.flags.ack == 1 and read the displayed count.
  • For complete connections: apply the filter tcp.completeness == 31 and read the displayed count.
  • For unique destination ports: go to Statistics > Conversations > TCP tab. Sort by port to see which services your machine connected to.
  • For DNS domains: apply the dns filter and scan the Info column for query names.
  • For TLS domains: apply tls.handshake.type == 1 and expand each Client Hello to read the SNI field.
  • Replace each bracketed placeholder in your report with the values you found. Save the file.

Where is the status bar?

The status bar runs along the very bottom of the Wireshark window. When you apply a display filter, it shows something like "Displayed: 12 of 847 packets". The "Displayed" number is the count you want for your report.

Seeing zero packets for a filter?

Make sure you're using the correct capture file from earlier. If you started a new capture, it won't have the HTTP, ping, or DNS traffic you generated in Step 2.

Help me figure out why my Wireshark filter shows zero packets.

Add your TCP handshake analysis

The final piece of your report is a detailed breakdown of one specific TCP handshake. This demonstrates you can read individual packet headers and understand connection timing.

  • In Wireshark, use Follow > TCP Stream on your HTTP connection to example.com (the same stream you analyzed in Step 3).
  • Note down the source IP, source port, destination IP, sequence numbers, window sizes, and timestamps from the first three packets.
  • In security_analysis_report.md, find the line that says ## DNS Activity. Add the following section directly above it:
## Detailed TCP Handshake Analysis

- Connection: [your IP]:[ephemeral port] > [server IP]:80
- Packet 1 (SYN): Seq=0, Win=[window size], Time=[timestamp]
- Packet 2 (SYN-ACK): Seq=0, Ack=1, Win=[window size], Time=[timestamp]
- Packet 3 (ACK): Seq=1, Ack=1, Time=[timestamp]
- Connection established in: [time delta] ms
- Analysis: Handshake completed normally with no retransmissions.

What values go in the placeholders?

  • [your IP] is the Source IP from Packet 1 (your machine's local IP address).
  • [ephemeral port] is the Source Port from Packet 1 (a random high number like 52431).
  • [window size] is the Window Size field in the TCP header of each packet.
  • [time delta] is the time difference between Packet 1 and Packet 3 (visible in the Time column).
  • Replace the bracketed placeholders with the actual values from your capture.
  • Save security_analysis_report.md.
  • Your completed report should have all sections filled in with real data from your network capture.

Can't find the TCP stream from earlier?

Apply the filter tcp.flags.syn == 1 and look for a SYN packet with destination port 80. Right-click it and select Follow > TCP Stream to isolate that conversation.

Help me find and follow a TCP stream in my capture.

✔️ Awesome, I've got everything!

Great. Double check you've saved your file with all sections populated.

ⓧ I'd like to double check the full code

Here is the complete security_analysis_report.md template with all sections in the correct order. Your actual values will differ based on your capture.

# Network Traffic Analysis Report

## Date: 2026-06-19
## Analyst: [Your Name]
## Capture Duration: ~5 minutes
## Interface: Wi-Fi / Ethernet
## Tool: Wireshark 4.6.6

---

## TCP Connections Observed

- Total SYN packets (new connections initiated): [count]
- SYN-ACK responses received: [count]
- Complete connections (handshake + data + close): [count]
- Destination ports observed: 80 (HTTP), 443 (HTTPS), 53 (DNS)

## Detailed TCP Handshake Analysis

- Connection: [your IP]:[ephemeral port] > [server IP]:80
- Packet 1 (SYN): Seq=0, Win=[window size], Time=[timestamp]
- Packet 2 (SYN-ACK): Seq=0, Ack=1, Win=[window size], Time=[timestamp]
- Packet 3 (ACK): Seq=1, Ack=1, Time=[timestamp]
- Connection established in: [time delta] ms
- Analysis: Handshake completed normally with no retransmissions.

## DNS Activity

- DNS queries made: example.com, google.com
- DNS server used: [your DNS server IP]
- Protocol: UDP port 53
- Security note: DNS queries are in plaintext, exposing visited domains to anyone on the network.

## Encryption Status

- Unencrypted HTTP connections: example.com (port 80)
- Encrypted HTTPS/TLS connections: google.com (port 443, TLS 1.3)
- Security concern: HTTP traffic to example.com exposes full request/response content in plaintext.

## ICMP Activity

- Ping target: 8.8.8.8 (Google Public DNS)
- Packets sent: 4 Echo Requests (Type 8)
- Packets received: 4 Echo Replies (Type 0)
- Response status: All successful

## Key Findings

1. All web browsing except example.com was encrypted via TLS 1.3
2. DNS queries are transmitted in plaintext, exposing visited domains to network observers
3. TCP handshakes completed successfully with no retransmissions observed
4. ICMP ping to 8.8.8.8 confirmed network connectivity with normal round-trip times

## Recommendations

- Avoid HTTP sites where possible; ensure HTTPS is used for any sensitive browsing
- Consider using encrypted DNS (DoH or DoT) to protect DNS queries from observation
- Monitor for unusual ICMP patterns that could indicate reconnaissance activity

Secret mission

Detect a SYN Flood Pattern with I/O Graphs

A SYN flood is one of the most common denial-of-service attacks. In this secret mission, you will use Wireshark's I/O Graphs to visualize traffic patterns and learn how SOC analysts detect the signature of a SYN flood in real time.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely on your local machine, so there are no ongoing costs or cloud resources to worry about. Decide whether to keep your resources installed, pause them to come back later, or delete them entirely.

Resources you used:

  • Wireshark 4.6.6 (installed application).
  • Npcap 1.88 (packet capture driver).
  • traffic_analysis.pcapng (saved packet capture file).
  • security_analysis_report.md (your analysis report).

Keep everything running

No action needed. Choose this if you plan to keep analyzing network traffic or want to revisit your capture file later.

  • Wireshark and Npcap remain installed and ready for future captures.
  • Your traffic_analysis.pcapng and security_analysis_report.md stay on disk.
  • Your saved filter bookmarks remain available in Wireshark.

Pause - I'll come back to this later

Since everything is local, there are no running processes to stop. Your files and installation will be waiting for you when you return.

  • Close Wireshark if it is still open.
  • Your capture file and report remain on disk until you delete them manually.
  • Wireshark and Npcap take up approximately 200 MB of disk space combined.

Delete - I don't want to use this again

Remove all project files and uninstall Wireshark and Npcap from your machine.

  • Delete your project files. Open File Explorer and navigate to wherever you saved traffic_analysis.pcapng and security_analysis_report.md. Delete both files.
  • Uninstall Npcap first. Open Settings, select Apps, then find Npcap in the list and click Uninstall.
  • Uninstall Wireshark. In the same Apps list, find Wireshark and click Uninstall. The uninstaller will remove core components but keep your personal settings by default. Select the option to remove everything if you want a full cleanup.

Nice Work!

Nice Work!

You just completed a real network traffic investigation using the same tool and workflow SOC analysts use every day. You captured live packets from your own machine, dissected them at the protocol level, and documented your findings in a structured security report.

You've learned how to:

  • Capture and analyze live network traffic with Wireshark, identifying TCP three-way handshakes (SYN, SYN-ACK, ACK) and reading TCP header fields at the packet level.
  • Use display filters to isolate DNS, HTTP, TLS, and ICMP protocols, and distinguish encrypted from plaintext traffic to identify security risks.
  • Document findings in a structured security analysis report covering TCP connections, DNS activity, encryption status, and ICMP patterns.
  • Secret Mission: Visualize traffic patterns with I/O Graphs to detect SYN flood attack signatures by analyzing the ratio of SYN packets to completed handshakes.

Ready to quiz yourself?