Lab 16 · Network Analysis Lab: Packet Analyser on Your Own Network

🎯 Objective

See the internet lesson become real packets — and learn to read a capture the way a network analyst starts an investigation.

🧩 Skills You Will Practice

• Packet capture basics
• DNS and TCP/TLS reading
• Display filters
• Privacy-aware analysis

🧰 What You Need

• Wireshark (free) on your own laptop
• Your own home network
• A capture journal
• The How the Internet Works lesson for reference

📋 Step-by-Step Tasks

1. Install Wireshark from its official site only. Start a capture on your own Wi-Fi interface and, for the first minute, just watch: record total packets, and the top protocols shown in Protocol Hierarchy.
2. Generate known traffic: open one website you choose. Stop the capture. Find the DNS query for that site using the dns display filter and record the query name and the answer IP — DNS from the lesson, now observed live.
3. Follow the connection: apply a filter for that destination IP, identify the TCP three-way handshake (SYN, SYN-ACK, ACK) and the TLS handshake that follows it. Note that with HTTPS you can see the handshake but not the page content — encryption, proven.
4. Compare with theory: note why there is no readable HTTP page text to find, which metadata IS still visible (IPs, timing, sizes), and one privacy conclusion an analyst would draw from metadata alone.
5. Use filters like a professional: dns, tls, tcp, and ip.addr equals your test site. Save 3 filtered screenshots descriptions in your journal (describe, do not share raw captures publicly).
6. Delete the capture file when finished, or store it privately: captures from your network can contain sensitive metadata about your household devices.

✅ Expected Result / Deliverable

A capture journal: protocol summary, one traced DNS query with its answer, the handshake sequence identified, 3 filters used, and a privacy conclusion — all from your own network only.

⚠️ Common Mistakes

• Capturing on a university, cafe or any network you do not own — that is interception, not a lab
• Sharing raw capture files publicly
• Expecting to read HTTPS content and concluding the tool is broken