Wireshark SOC Lab 4 | How to capture Packets on your Network & PC?

This lab runs on your own laptop, not in the browser. Follow the steps below, then type your answers in the task box.

You need

• A Windows laptop or PC with Wireshark installed
• Google Chrome
• An internet connection

You can follow the PDF or this page. Both have the same steps.

Step 1 Clear the DNS cache

Close all browser windows. Open Command Prompt and run this command:

ipconfig /flushdns

You should see Successfully flushed the DNS Resolver Cache. Without this step your laptop may remember the website and skip the DNS query.

Step 2 Start the capture

Open Wireshark. On the start screen, double-click the adapter that shows a moving line (usually Wi-Fi). The capture starts at once.

Step 3 Open the website and stop the capture

Open a new Incognito window in Chrome (Ctrl + Shift + N) and go to the website. Wait until the page loads fully.

https://networkwalks.com

Come back to Wireshark and stop the capture with the red square button.

Step 4 Find the DNS packets Tasks 1, 2 and 3

Type this in the display filter bar and press Enter:

dns.qry.name == "networkwalks.com"

You should see two packets, a query and a response.

Click the query. The Source is your laptop and the Destination is your DNS server. These are Task 1 and Task 2.

Now click the response. In the middle pane expand Domain Name System (response), then Answers. The Address is the website IP. This is Task 3.

Tip. If no packet shows, close the browser fully, run ipconfig /flushdns again and capture again. Also check that Chrome Secure DNS is off (Settings > Privacy and security > Security > Use secure DNS).

Step 5 Find the TLS Client Hello Tasks 4 and 5

Use this filter:

tls.handshake.type == 1

This shows the Client Hello, the first packet of the secure connection. Click the one that says SNI=networkwalks.com. Its Destination is the website IP. Expand Transport Layer Security > Handshake Protocol: Client Hello > Extension: server_name. The Server Name is Task 4.

Then expand the Transmission Control Protocol line. The Destination Port is the server port. This is Task 5.

Tip. If the Protocol column says QUIC, this is normal. Chrome uses QUIC (HTTP/3) on port 443 for some sites. The filter still works. If you see no packet, try the capture again with a fresh Incognito window.

Step 6 Find the TLS Server Hello Task 6

Apply this filter:

tls.handshake.type == 2

This shows the Server Hello, the reply from the website. Pick the one where the Source is the website IP from Step 4. Look at the Protocol column. It shows the TLS version.

When you finish all six tasks, press Finish in the task box to see your result.