Project 2: Network Packet Analysis

Module: Module 1: Reconnaissance, Networking & First Vulnerabilities  |  Level: Beginner  | 
Primary tool: Wireshark  |  Estimated time: 45–75 minutes

Objective: Capture and interpret live or sample traffic to identify protocols and anomalies.

Free lab environment

CyberDefenders free forensics challenges + Wireshark Sample Captures — https://cyberdefenders.org/blueteam-ctf-challenges/ and https://wiki.wireshark.org/SampleCaptures

Wireshark’s official wiki hosts a large library of free, legally shareable sample .pcap files for exactly this kind of exercise. CyberDefenders’ free challenge tier includes downloadable evidence files (disk images, logs, memory dumps) with model answers you can self-check against.

Lab workflow

1. Download the evidence file(s) from a sample .pcap from the Wireshark Sample Captures wiki and verify you have the correct, complete file before analysis.
2. Open it in Wireshark and get an overview (protocol hierarchy, file listing, or timeline view) before diving into individual events.
3. Narrow your analysis specifically to capture and interpret live or sample traffic to identify protocols and anomalies, using filters rather than manually scrolling through everything.
4. Reconstruct a timeline of at least 3 connected events, in order, with a timestamp for each.
5. State your root-cause conclusion in one sentence, then list the specific evidence that supports it.
6. Package your timeline and conclusion into the report format described below.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• Wireshark’s protocol hierarchy statistics view for the capture
• a filtered view isolating one suspicious or noteworthy conversation, with your annotation

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.