Lion Cipher Lab
Install and configure Wireshark for packet analysis
- SOC Analyst / Blue Team
- Beginner
- ~40 min
- Free · no account required
Why it matters
Wireshark is the free, industry-standard tool for looking at network traffic one packet at a time, and being able to read a capture is a core SOC, incident-response and network-troubleshooting skill. But a tool you cannot capture with is useless, and the setup is exactly where beginners give up: the wrong download, a missing capture driver on Windows, or the very common mistake of running the whole program as root just to make capture work. This lab gets Wireshark installed and configured properly — capturing without root, with columns, a profile, coloring rules and name resolution set up so…
What you'll learn
- installing Wireshark on Windows, macOS or Linux
- setting up capture permissions safely (npcap on Windows, the non-root wireshark group on Linux)
- understanding why you never capture as root/administrator
- choosing the right capture interface
- customising columns for readable packet lists
- creating and using a Wireshark configuration profile
- setting up coloring rules and name-resolution preferences
- running a first test capture to confirm the tool works
Steps in this lab
- What Wireshark is — and four words you'll need
- Authorization first: your own network only
- Download and install Wireshark for your OS
- Give yourself capture permission — without running as root
- Open Wireshark and pick a capture interface
- Set up columns that make a capture readable
- Save your setup as a profile — and turn on coloring
- Tune name resolution so packets read in plain names
- Prove it works with a tiny test capture
- Why the setup matters as much as the tool