Lab 12 — Read Your First Packet Capture (Wireshark)

Open Wireshark. The first screen is a list of every network interface on the machine, and most of them are doing nothing. Beside each name is a small moving line — a live activity graph.

Pick the one that is wiggling. That is the card carrying your internet traffic: usually Wi-Fi or Ethernet on Windows, en0 on a Mac, wlan0 or eth0 on Linux. Ignore anything called Loopback, VirtualBox, VMware, Bluetooth or Npcap Loopback for now.

Double-click it. Capture starts straight away.

Why this trips people up. A laptop can easily list a dozen interfaces. Capture on the wrong one and you get a blank screen with no error message, decide the tool is broken, and give up. The wiggling line is the whole trick.

Lines are already flooding in. Do not try to read them. Instead, do something deliberate so you have something to find later:

1. Open a browser and visit http://neverssl.com — one page load, nothing else. It is a site that exists specifically to serve a plain, unencrypted page.
2. Then visit https://stashgrid.ai.
3. Come back to Wireshark and press Ctrl + E to stop. On a Mac that is Cmd + E.

You now have a frozen snapshot, probably a few thousand packets. Stopping matters: reading a list that is still scrolling is hopeless.

What you are looking at. One row is one packet. The columns that matter are Source and Destination (who is talking to whom), Protocol (what language), and Info (a plain-English summary Wireshark writes for you). The rest can wait.

The bar across the top, below the toolbar, is the display filter. Click in it, type three letters, press Enter:

> dns

Thousands of packets collapse down to a few dozen. Each pair is your computer asking “what is the address for this name?” and a server answering. Find the one that says Standard query A stashgrid.ai, and directly under it the response carrying the answer.

The filter bar turns green when what you typed is valid and red when it is not. Red means a typo, not a problem with your capture.

The attacker’s view. These lookups are, by default, sent in the clear. Anyone positioned on the network — or running it — gets a readable list of every site you visited, without decrypting a single thing. This is exactly why one writer could not hide his browsing from his internet provider: he encrypted the pages and left the questions in the open.

The defender’s move. Encrypted DNS (DoH or DoT) in your browser or router closes this one. Run your own resolver and you can watch it happen: the Unbound DNS lab builds one.

Now the part that makes the penny drop. Change the filter to:

> http

Find the line whose Info column begins GET / and mentions neverssl. Right-click it → Follow → HTTP Stream.

A window opens containing the whole conversation as text. Your request in one colour, the server’s reply in another: the browser you used, the page you asked for, and the actual HTML that came back. Not a summary. The thing itself.

This is what every login form looked like in 2010. Username and password, sitting in a window, readable by anyone on the same coffee-shop Wi-Fi. That is not a story about careless users. That was simply how the web worked. — Nyx

Why it matters. People are told “always use HTTPS” and nod without ever seeing the alternative. You have now seen it. Everything that follows about certificates, padlocks and warnings is a reaction to this window.

Close that window and filter for the encrypted traffic instead:

> tls

Pick any packet marked Application Data and follow it the same way: right-click → Follow → TLS Stream. The window opens and contains… garbage. Random bytes. No page, no headings, no text.

That is the entire value of the padlock, demonstrated in two clicks. Same tool, same network card, same position on the wire — and now there is nothing to read.

A quick correction while we are here: it is TLS, not SSL. SSL was replaced over twenty years ago and Wireshark renamed the filter to match. If a tutorial tells you to type ssl in that box, you are reading something old enough to be wrong about other things too. — Nyx

Encrypted does not mean invisible. Before any encryption begins, your computer has to tell the server which site it wants — and in most connections it does so in the clear. Filter for the very first message of the handshake:

> tls.handshake.type == 1

These are Client Hello packets — your side opening the conversation. Click one, and in the middle pane expand Transport Layer Security → Handshake Protocol: Client Hello → Extensions, then find server_name. There is the hostname, as plain text, inside an otherwise encrypted connection.

Want only that field? Try this filter:

> tls.handshake.extensions_server_name

The point of the whole lab. HTTPS protects what you said. It does not, on its own, hide who you said it to. Between this field and the DNS lookups from step 3, a watcher on the network can reconstruct your browsing history without breaking any encryption at all. That gap is why VPNs, encrypted DNS and private browsing get argued about — and knowing exactly which part each one covers is what separates an informed answer from a sales pitch.

Fairness demands a caveat: a newer feature called Encrypted Client Hello hides this field too, and it is gradually being switched on. It needs support at both ends, so it is not yet the normal case — check your own capture rather than assuming either way. — Nyx

Press Ctrl + Shift + S and save as .pcapng. Captures are evidence: in a real incident the file is the artefact everyone else works from, so saving before you start experimenting is a habit worth building early.

Before you close it, one distinction that confuses everybody. Wireshark has two filter systems and they use different languages:

• Capture filter — set on the start screen, before capturing. It decides what gets recorded at all. Written like host 192.168.1.10 or port 53. Anything it excludes is gone for good.
• Display filter — the bar at the top, used after. It only changes what you are shown; nothing is lost. Written like ip.addr == 192.168.1.10 or dns.

Two syntaxes. host in one, ip.addr == in the other. Typing a display filter into the capture box is the single most common beginner error, and the message you get back does not explain itself.

Rule of thumb: capture everything, filter afterwards. Only reach for a capture filter when you are recording for hours and disk space is the problem.

One more worth knowing. Statistics → Conversations, then the IPv4 tab, sorted by Bytes. One screen showing every machine your computer spoke to and how much it said to each. On a quiet network, an unfamiliar address near the top is the kind of thing that starts an investigation.