Lion Cipher Lab
Summarize a packet capture with a local LLM — then verify every claim it makes
- AI Security
- Intermediate
- ~60 min
- Free · no account required
Why it matters
A raw packet capture is thousands of packets no human wants to scroll through, and the first question on any incident is the boring one: what actually happened on this wire — who talked to whom, over what, and where did it reach out? A language model can turn a capture into a readable paragraph in seconds, which is genuinely useful for a first-pass triage or a shift handover. The trap is believing it. A model — especially a small one you run for free on your own laptop — will confidently invent a conversation that never happened, misread a port, and hallucinate a DNS name that is nowhere in…
What you'll learn
- capturing your own benign traffic to a pcap with tshark
- extracting structured features from a capture with tshark -z (protocol hierarchy, conversations, DNS, HTTP)
- feeding a compact extract (not raw packets) to a local LLM for a plain-English summary
- verifying every LLM claim against the pcap with tshark display filters
- deliberately catching a confident hallucination (an invented host, port, or domain)
- measuring an LLM summary's accuracy / hit rate instead of trusting it
- treating capture-derived strings as untrusted input (prompt injection, OWASP LLM01)
- judging when an LLM summary is useful (first-pass triage) and when it must never be evidence
Steps in this lab
- Why extract-then-summarize beats dumping raw packets
- Install Wireshark and tshark
- Install Ollama and a small local model
- Capture your own benign traffic to a pcap
- Extract structured features with tshark -z (never raw packets)
- Summarize the extract with the local model
- Verify every claim against the pcap and catch a hallucination
- Measure the hit rate — don't just vibe-check it
- The capture is untrusted input — watch for prompt injection
- When an LLM summary helps, when it must not — and the pro move