Lion Cipher Lab
Capture and read your first packets with Wireshark
- SOC Analyst / Blue Team
- Beginner
- ~40 min
- Free · no account required
Why it matters
A packet is the small, self-contained unit of data that networks move things in — every web page, DNS lookup, and video call is chopped into packets, sent, and reassembled. Wireshark is the tool that lets you freeze that flow and read the packets one by one, and it is the single most common way defenders, network engineers, and incident responders answer "what is actually going over this wire?" Being able to start a capture, filter it, and follow a conversation is assumed knowledge across the field: countless external traffic-analysis exercises hand you a capture file and expect you to…
What you'll learn
- installing Wireshark
- capturing on your own interface
- reading the packet list
- display filters (dns, http, tcp)
- following a TCP stream
- seeing that HTTP is readable but HTTPS is encrypted
Steps in this lab
- First: capture only your own traffic, on your own network
- What Wireshark is, and installing it
- Pick your active interface and start a capture
- Generate a little harmless traffic
- Stop the capture and read the packet list
- Filter to what matters: find the DNS lookup
- Follow a whole conversation: the TCP stream
- The lesson that sticks: HTTP is readable, HTTPS is not
- Why this small skill opens so many doors