Lion Cipher Lab
Investigate a saved packet capture (pcap)
- Digital Forensics & IR (DFIR)
- Beginner
- ~45 min
- Free · no account required
Why it matters
Capturing traffic is only half of network forensics; the other half is what you do with the file afterward. When something has already happened — a suspicious connection, an alert, an incident — you often have a saved capture and a question: who talked to whom, over what, and what was said? Learning to open a pcap and work it methodically (filter to the traffic that matters, follow a single conversation end to end, use the summary statistics to see the shape of the whole file, and pull out the concrete indicators) is a core, employable DFIR and SOC skill. It's also the safest possible way to…
What you'll learn
- opening a saved pcap in Wireshark
- applying display filters (http, dns, ip.addr==)
- following a TCP/HTTP stream to reconstruct a conversation
- reading Statistics > Conversations and Protocol Hierarchy
- extracting indicators (hosts, domains, user-agents)
- writing up what a capture shows
Steps in this lab
- Get a capture to work — yours or a public sample
- Open it and get oriented
- Filter to what matters with display filters
- Follow a stream to reconstruct the conversation
- See the whole file's shape with Statistics
- Pull out the indicators and write them down
- Why after-the-fact analysis is the real skill