Lion Cipher Lab
Analyze traffic with Wireshark
- SOC Analyst / Blue Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Recording traffic is the easy half; making sense of it is the job. A single minute of a busy machine is thousands of packets, and staring at them in order tells you almost nothing. The skill that turns that wall of rows into an answer is filtering and following conversations — narrowing to one host, one port, or one protocol, then reassembling a request and response so you can read it like a transcript. This is the core, everyday motion of a SOC analyst or incident responder inspecting a capture, and it is completely safe to practise: you work a saved file you own, as many times as you like,…
What you'll learn
- the difference between a capture filter and a display filter
- writing display filters (ip.addr, tcp.port, http, dns, tcp.flags)
- reading a DNS query and its response
- recognising a cleartext HTTP request and what it leaks
- using Follow TCP/HTTP Stream to reassemble a conversation
- reading Statistics: Protocol Hierarchy and Conversations
- exporting objects (files) carried in a capture
Steps in this lab
- The one distinction that trips everyone up: capture filter vs display filter
- Open a capture — your own, or a safe public sample
- Your first display filters: narrow by address and by port
- Filter by protocol: just type its name
- Read a DNS query and its response
- Spot a cleartext HTTP request — then Follow the Stream
- Zoom out with Statistics, and pull files back out with Export Objects
- What you actually learned — seeing a packet is not understanding it