Wireshark Lab: 7 Hands-On Lab Exercises step by step(Beginner to Advanced 2026)

Reading about Wireshark teaches you nothing. Doing it teaches you everything.

This is a structured, hands-on Wireshark lab — seven real exercises, each with step-by-step instructions and annotated screenshots showing exactly what you should see on screen at every critical moment. No guessing. No confusion.

By the time you finish Lab 7, you will have captured live HTTP credentials, reconstructed a full TCP session, detected a port scan, analyzed DNS traffic, and extracted a file from a packet capture. These are skills used in real penetration tests and forensic investigations every day.

Before diving in, make sure you’re comfortable with how TCP, DNS, and ARP work. If not, read our Networking Basics for Hackers guide first — it will make every lab below significantly clearer.

Lab 1 — Your First Live Capture

⏱ 10 minutes  |  Difficulty: Beginner

Objective: Start Wireshark, capture live traffic, save it as a .pcap file, and identify at least three protocols.

Step 1 — Open Wireshark and select your active interface

Launch Wireshark. The Welcome Screen shows all available network interfaces. Look for the one with a moving sparkline graph — that’s the interface actively receiving traffic.

Steps 2–4 — Capture, generate traffic, and stop

Double-click the active interface. Packets begin flooding in immediately. Open your browser and visit 3 websites. Press Ctrl+E to stop, then File → Save As → name it lab1_capture.pcap.

Step 5 — Identify protocols in the Protocol column

Look at the Protocol column in the Packet List. Find at least 3 different protocols. Here’s what a typical capture looks like:

Lab 2 — Capture HTTP Credentials in Plain Text

⏱ 15 minutes  |  Difficulty: Beginner  |  ⚠ Your own machine only

Objective: Capture an HTTP POST login submission and read the username and password directly from the packet — in plain, readable text.

Steps 1–2 — Start capture and submit login form

Start a new capture. Browse to http://testphp.vulnweb.com/login.php. Enter username testuser and password testpass123. Click Login. Return to Wireshark and press Ctrl+E to stop.

Step 3 — Apply the POST filter

In the display filter bar, type http.request.method == "POST" and press Enter. You’ll see the login submission packet appear:

Step 4 — Expand the HTML Form URL Encoded layer

In the Packet Details pane below the packet list, click the arrow next to “HTML Form URL Encoded” to expand it. Your credentials appear in plain text:

Lab 3 — Follow a TCP Stream

⏱ 10 minutes  |  Difficulty: Beginner

Objective: Reconstruct and read a complete HTTP conversation between your browser and a web server using Follow TCP Stream.

Steps 1–2 — Capture HTTP and filter for GET requests

Start a capture, visit http://example.com or http://testphp.vulnweb.com, then stop. Apply the filter http. Find a packet labelled GET / HTTP/1.1 in the Info column.

Step 3 — Right-click → Follow → TCP Stream

Step 4 — Read the reconstructed conversation

Lab 4 — DNS Traffic Analysis

⏱ 15 minutes  |  Difficulty: Beginner–Intermediate

Objective: Capture and analyze DNS queries and responses. Understand what DNS traffic reveals — and learn to spot C2 beaconing patterns. This pairs directly with DNS Reconnaissance with dnsrecon, where you use these same insights offensively.

Steps 1–3 — Capture DNS and identify queries vs responses

Start a capture. Apply the dns filter. Visit 5 different websites. Look at the Info column — Standard query = outbound, Standard query response = answer.

Lab 5 — Detect a Port Scan in Wireshark

⏱ 15 minutes  |  Difficulty: Intermediate  |  ⚠ Localhost only

Objective: Generate a port scan against your own localhost using Nmap, capture it in Wireshark, and identify the SYN packet signature. Keep our Nmap Cheat Sheet open in a second tab — you’ll use several commands from it here.

Steps 1–2 — Capture on Loopback, run the Nmap scan

Start Wireshark on the Loopback (lo) interface. Apply the filter tcp. Open a terminal and run:

Step 3 — Apply the SYN scan filter

Stop the capture. Apply this filter:

Step 4 — Find open ports with the SYN-ACK filter

Now change the filter to see which ports responded with SYN-ACK (open port confirmation):

Each SYN-ACK = one open port. Compare the destination ports shown here with Nmap’s terminal output — they should match exactly.

Lab 6 — Export a File from a Packet Capture

⏱ 10 minutes  |  Difficulty: Intermediate

Objective: Extract a file transmitted over HTTP directly from a .pcap using Wireshark’s Export Objects feature — the same technique used in forensic investigations.

Steps 1–2 — Download a practice pcap and open it

Download http.cap from wiki.wireshark.org/SampleCaptures. Open via File → Open. Apply the http filter to confirm it contains HTTP traffic.

Step 3 — Go to File → Export Objects → HTTP

Lab 7 — Analyze a Real Malware pcap

⏱ 20 minutes  |  Difficulty: Intermediate–Advanced

Objective: Identify infected host, C2 server, beaconing behavior, and suspicious DNS. Before starting, read What Is Malware and how it infects computers — understanding malware behavior makes these traffic patterns immediately recognizable.

Step 2 — Check Protocol Hierarchy (Statistics menu)

Open the pcap. Go to Statistics → Protocol Hierarchy. This reveals the full breakdown of every protocol in the capture instantly:

Steps 3–6 — Find infected host, C2 DNS, and beaconing

Find infected host: Statistics → Endpoints → IPv4 → sort by Bytes. The internal IP (192.168.x.x) with most outbound traffic = infected host.

Find C2 via DNS filter: Apply dns and ip.src == [infected IP]. Look for random domain names (e.g. xkf93nd.top) — DGA malware domains.

Detect beaconing: Apply ip.src == [infected IP] and tcp. Look at the Time column for outbound connections to the same external IP repeating at fixed intervals (e.g. every 60 seconds) — that is your C2 beacon.

Follow the C2 stream: Right-click a beacon packet → Follow → TCP Stream. If the C2 traffic is unencrypted you may read commands or exfiltrated data in the stream window (same red/blue format as Lab 3).

Lab-Ready Filter Reference Card

Common Lab Mistakes — And How to Fix Them

Frequently Asked Questions