Computer Networking · Advanced level

Advanced level · Module 4: Monitoring and Troubleshooting Complex Networks · Lesson 2 of 4

Packet Analysis with Wireshark

See exactly what is happening on the network.

In this lesson you will

  • Capture and filter traffic
  • Interpret common protocol exchanges

Key concepts

packet capturedisplay filtersTCP handshakeDNS and DHCP in captures

The lesson

Wireshark captures packets and shows each protocol layer. Capture only where you are authorised, because traffic can contain personal data.

Display filters such as dns, dhcp or tcp.port == 443 focus on what matters.

Reading exchanges — the TCP handshake, DNS queries and replies, DHCP DORA — reveals where communication breaks down.

Step by step

  1. Capture traffic in the lab.
  2. Filter DNS and DHCP.
  3. Find a TCP handshake.
  4. Explain a failed connection.

Practice activity

Analyse the provided capture and explain the fault.

Expected result: A correct explanation supported by packet evidence.

Check your understanding

  1. Why must packet captures be authorised?

    Show answer

    They can contain personal and sensitive data.

  2. Give a Wireshark display filter for DNS.

    Show answer

    dns.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.