Wireshark Exercises
Sharpen network analysis skills with a collection of hands-on Wireshark exercises. These practical challenges are designed to test and improve proficiency in packet capture, filtering, and protocol analysis. Each exercise presents a real-world scenario, providing opportunities to apply knowledge in network troubleshooting, security analysis, and performance monitoring. Progress through these labs to gain practical experience with the world's foremost network protocol analyzer.
Discover categories
AllLinuxDevOpsCybersecurityDevOps EngineerCybersecurity EngineerDevSecOpsKali LinuxRed Hat Enterprise LinuxRHCSA TrainingRHCE in Enterprise Linux TrainingLFCS TrainingShellGitDockerKubernetesCKA TrainingCKAD TrainingCKS TrainingAnsibleRHCE in Ansible TrainingJenkinsNmapWiresharkHydraCompTIADatabaseMySQLPostgreSQLRedisMongoDBSQLitePythonGolangJavaCC++Web DevelopmentData Science
Use Nmap to Scan and Document Network Services
In this lab, you will learn how to use Nmap to scan and document network services. You'll start by setting up a web server, then use Nmap to scan for open ports and identify running services. Finally, you'll document your findings in a report.
LabWireshark
Analyze PCAP Files with tcpdump
In this challenge, you will act as a Security Analyst investigating a potential breach. Use tcpdump to analyze a noisy PCAP file, identify the attacker, and extract stolen credentials.
ChallengeWireshark
Berkeley Packet Filters (BPF)
In this lab, you will master Berkeley Packet Filters (BPF) to surgically isolate network traffic using tcpdump. You will learn how to write filters based on specific IP addresses, subnets, and ports.
LabWireshark
Inspecting Packet Contents
In this lab, you will go beyond network packet headers and learn how to inspect the actual payload data using tcpdump. You will utilize hexadecimal and ASCII output formatting flags to manually read and extract unencrypted application-layer traffic.
LabWireshark
Network Interface and Basic Capture
In this lab, you will learn the fundamentals of network traffic analysis using the command-line packet analyzer tcpdump on Linux. You will practice identifying network interfaces, capturing live raw traffic, and managing capture length to understand the basic flow of data across a network.
LabWireshark
PCAP File Management
In this lab, you will learn essential digital forensics skills by saving live network traffic captures to PCAP files, reading them back for offline analysis using tcpdump, and applying filters to retroactively investigate network events.
LabWireshark
Automated Traffic Analysis
In this challenge, you will act as a Threat Hunter. Given a packet capture containing malware activity, use tshark to extract DNS queries, pinpoint the C2 domain, and extract the malicious HTTP URI.
ChallengeWireshark
Extracting Fields and Formatting
In this lab, you will learn how to parse network traffic for automated analysis. You will customize tshark's output to extract specific protocol fields and format them into clean, comma-separated values (CSV).
LabWireshark
Following Network Streams
In this lab, you will learn how to reconstruct fragmented network conversations using tshark. By following complete TCP streams, you will stitch packets back together and view the entire interaction.
LabWireshark
Introduction to Tshark
In this lab, you will explore tshark, the powerful command-line counterpart to Wireshark. You will learn how to capture traffic and apply display filters that inherently understand protocol structures like HTTP and DNS.
LabWireshark
Packet-to-Alert Investigation
In this challenge, you will investigate suspicious network activity by capturing traffic, reconstructing a malicious conversation, extracting indicators, and preparing an analyst alert.
ChallengeWireshark