Wireshark SOC Lab 5 | How to analyze a PCAP file?

This lab runs on your own laptop, not in the browser. Download the pcap file, follow the steps below, then type your answers in the task box. Everyone gets the same file, so everyone gets the same answers.

You need

• A Windows laptop or PC with Wireshark installed
• The lab zip file (it holds the pcap file Wireshark_Lab2_Microsoft_DNS_v2.pcap)

You can follow the PDF or this page. Both have the same steps. Unzip the file before you open it.

Step 1 Open the pcap file

Open Wireshark. Go to File > Open, pick Wireshark_Lab2_Microsoft_DNS_v2.pcap and click Open. The packets load at once.

Step 2 Find the DNS packets Tasks 1 and 2

Type this in the display filter bar and press Enter:

dns.qry.name == "microsoft.com"

You should see four packets, two queries and two replies. Click the first query (packet 26). The Source is the laptop that made the capture and the Destination is its DNS server. These are Task 1 and Task 2.

Step 3 Read the DNS answers Task 3

With the same filter, click the first reply (packet 27, Standard query response A). In the middle pane expand Domain Name System (response), then Answers. Every Address line is an IP address of microsoft.com. Write down all of them.

Tip. The second reply (packet 29) is for IPv6 and has no answer. Use packet 27.

Step 4 Find the TLS Client Hello Tasks 4 and 5

Use this filter:

tls.handshake.type == 1

This shows the Client Hello, the first packet of each secure connection. Click packet 33. Its Info says SNI=microsoft.com. Expand Transport Layer Security > Handshake Protocol: Client Hello > Extension: server_name. The Server Name is Task 4. Then expand Transmission Control Protocol. The Destination Port is Task 5.

Tip. Packet 73 is a second Client Hello for the same name. Either one gives the same answers.

Step 5 Find the TLS Server Hello Task 6

Apply this filter:

tls.handshake.type == 2

This shows the Server Hello, the reply from the website. Pick the packet where the Source is 20.70.246.20 (packet 35). Look at the Protocol column. It shows the TLS version.

When you finish all six tasks, press Finish in the task box to see your result.