In this example, the first 3 frames are the interested traffic. Select the saved pcap file located at /home/analyst/capture.pcap.Ĭ. Click OK when prompted by the warning regarding running Wireshark as superuser. Part 2: Analyze the Packets using Wireshark Step 1: Apply a filter to the saved capture.Ī. After the tcpdump starts, quickly navigate to 172.16.0.40 in the Firefox web browser. This capture will stop after capturing 50 packets, as it is configured with the option -c 50. With the -v option, you can watch the progress. After the Firefox window opens, start a tcpdump session in the terminal Node: H1 and send the output to a file called capture.pcap.

home/analyst//scripts/reg_server_start.shĮ. Log in with username analyst and the password cyberops.ī. Internet access Part 1: Prepare the Hosts to Capture the TrafficĪ.A PC can have multiple, simultaneous, active TCP sessions with various web sites. For example, when a PC uses a web browser to surf the Internet, a three-way handshake is initiated, and a session is established between the PC host and web server. In this lab, you will use Wireshark to capture and examine packets generated between the PC browser using the HyperText Transfer Protocol (HTTP) and a web server, such as When an application, such as HTTP or File Transfer Protocol (FTP) first starts on a host, TCP uses the three-way handshake to establish a reliable TCP session between the two hosts. Part 3: View the Packets using tcpdump Background / Scenario.Part 2: Analyze the Packets using Wireshark.Part 1: Prepare the Hosts to Capture the Traffic.

Source port filter wireshark