Live capture with Wireshark
You start a live capture on eth0 in Wireshark, watch your own web, DNS and ping traffic in real time, catch the request to the page named in your task, stop and save the capture; at the end you work out the capture’s packet count and the server’s answer yourself. The requested page differs in every lab.
Level 101 · 45 min
A complaint came in about the company’s internal website (web.lab): "sometimes it is slow to open". Your team lead wants you to look live at what really happens on the network. Your task file: ~/gorev.txt.
In a live capture Wireshark puts the packets crossing the network card on the screen as they happen. dumpcap runs in the background and writes the packets to a temporary file under /tmp; if you don’t save it when you stop, the file is lost. The figure shows the life cycle of a live capture.
Important: capturing on someone else’s network without permission is a crime. This is a closed lab network that belongs only to you.
What you will do in this lesson
- Open Wireshark empty
- Start the capture
- Make traffic and watch it
- The page in your task
- ICMP: ping
- Stop the capture
- Save
- How many packets?
- What did the server answer?
- Short quiz
Skills you will earn
- Opening a capture file in Wireshark
- Starting, watching and stopping a live capture in Wireshark
- Saving a live capture as pcapng
- Reading a capture file’s properties
- Matching an HTTP request and its answer (status code, Server)
← Wireshark coloring rules · Wireshark fundamentals · Saving PCAPNG in Wireshark →
Start for free