YanoSecYou want to explain a network exchange after it happened. A packet capture saves the traffic visible at a particular recording point. Before interpreting a missing reply, identify where and how that record was obtained.
A frame is a link-layer unit, such as an Ethernet frame. In these examples it contains an IPv4 packet, which can contain a TCP segment or UDP datagram. A capture file stores records of such traffic with information such as lengths and timestamps. PCAP and pcapng are capture-file formats.
The supplied pcapng files are synthetic: their bytes were constructed for teaching rather than recorded from a live interface. Their tables and transcripts provide the complete browser route. You can inspect that evidence without selecting an interface, starting a capture or observing anyone else's traffic.
Before you begin
- Recommended first
- Files, programs, and processes, Processes, Packages with apt, TCP, UDP, and the three-way handshake
- Estimated time
- 15 min reading, 15 min activity. Setup and optional practice may take longer.
- Where you work
- Use the supplied original network cards, packet tables and stream transcripts in any browser, including on a phone. You need no account, paid lab or live network access. Reading a saved file in Wireshark is optional; installation time is separate from the estimate. Optional challenges take about ten extra minutes.
- Without a lab
- The page prints every address, row and message needed for its activity. Follow the numbered steps in notes and label your conclusions as predictions or interpretations of supplied evidence. The pcapng files are synthetic, constructed examples; opening one is different from recording a network. Reading works without JavaScript. Answer checking needs JavaScript and a secure context, such as HTTPS. Saving correct progress also needs usable browser storage.
After this lesson you can:
- Identify the context, timestamp and endpoints of a supplied frame.
- Separate synthetic stored records from paper-only models.
- Explain why a missing packet is a limit of the evidence.
01Example
W1 is a paper-only worked frame. It models a UDP packet from desk toward gate but is deliberately absent from intro-demo.pcapng. Use that distinction to keep the printed model separate from the file's actual supplied records.
Paper frame W1
Link direction: desk toward gate
IPv4: 192.168.50.10 -> 192.0.2.10
UDP ports: 49152 -> 9
Payload on the card: map
192.0.2.10 is a documentation address.
W1 is not a frame in intro-demo.pcapng.02What the record can show
The capture point is the place where recording occurs. The table models an interface named lab0 on desk. That name is only a teaching label; the synthetic file records interface identifier 0 without storing the name lab0. A file and its accompanying description can therefore supply different kinds of context.
A timestamp labels when a record was taken or modeled. Here offsets are measured from 2026-01-01 00:00:00 UTC. One microsecond is one millionth of a second; offsets 0.000001 and 0.000002 are one and two microseconds. These are constructed times, not observed delays or evidence of real network speed.
Source and destination describe the direction of each row. The IP source can become the destination on a reply; read the current row instead of assuming the left host always sends. The activity table also supplies ports and setup flags, with no application payload in those three frames.
A capture point cannot necessarily see traffic on another link. Capture selection, dropped records, a stopped recorder or a limited saved length can also leave evidence out. An absent row therefore does not prove a packet never existed, and it does not prove that a particular missing packet did exist.
Real captures can contain private application data and identifying metadata. These supplied files use original lab/documentation values. Keep the activity to those records; reading a synthetic file supplies no permission to capture a shared network.
Read each direction and provenance field on paper W1; do not invent stored capture bytes or absent events.Model. A teaching model drawn by hand. It shows the idea, not real tool output.
Read the full explanation below.
Paper W1, not stored capture bytes
Paper frame W1
Link direction: desk toward gate
IPv4: 192.168.50.10 -> 192.0.2.10
UDP ports: 49152 -> 9
Payload on the card: map
W1 is not a frame in intro-demo.pcapng.
desk toward gate is the local-link direction, not a substitute for the IP destination.
This is a paper frame.
desk toward gate is the local-link direction, not a substitute for the IP destination.
Follow the explanation
- desk toward gate is the local-link direction, not a substitute for the IP destination.
- IPv4 source is 192.168.50.10 and destination is the documentation address 192.0.2.10.
- UDP source port 49152 points to destination port 9; payload map belongs to this card.
- W1 is not in intro-demo.pcapng, which contains only the stated TCP setup frames.
Read every state and value
1. desk toward gate is the local-link direction, not a substitute for the IP destination.
- Selected parts
- Local-link direction
- Explanation
- link-note
2. IPv4 source is 192.168.50.10 and destination is the documentation address 192.0.2.10.
- Selected parts
- IPv4 source · IPv4 destination
- Explanation
- ip-note
3. UDP source port 49152 points to destination port 9; payload map belongs to this card.
- Selected parts
- UDP source port · UDP destination port · Paper payload
- Explanation
- udp-note
4. W1 is not in intro-demo.pcapng, which contains only the stated TCP setup frames.
- Selected parts
- Paper/capture boundary
- Explanation
- source-note
03Read the three frames that were serialized
The title refers to the three frames written into intro-demo.pcapng: A1, A2 and A3. The table supplies every one of them. Identify the capture-point model, then read A2's direction and endpoints before comparing with the printed check.
The 2026-10-12 exercise record reports that TShark, Wireshark's command-line reader, read three frames with zero TCP payload bytes. That earlier file read supports the supplied record; it was not a live capture or a Wireshark graphical session.
Packet-record term
Snap length is the maximum number of bytes stored from each packet. A
longer packet can be stored only in part. It is a recording limit, not
proof that every packet reached the recording point.
Read a packet record with its context
A frame is a local-link unit; its payload here contains an IP packet.
Source and destination state the direction of a particular row. The
reply can reverse those roles, so read both addresses each time.
A timestamp labels a record time. These synthetic offsets are measured
from the stated UTC base; one microsecond is 0.000001 second. They are
constructed values, not measured network latency. The complete table
below lets you trace every supplied frame without opening a file.
Synthetic packet table. Not a live capture. Not Wireshark output.
Capture point: fictional interface lab0 on host desk.
Clock label: 2026-01-01 00:00:00 UTC plus the offset. Display timezone is not claimed.
Snap length on the card: 65535.
This table is not every frame in the lab.
Worked frame, paper only. It is not inside intro-demo.pcapng.
Frame Offset Source MAC Destination MAC IPv4 source IPv4 destination Transport
W1 0.000000 00:00:5e:00:53:10 00:00:5e:00:53:01 192.168.50.10 192.0.2.10 UDP 49152 to 9
Payload on the card: map
192.0.2.10 is documentation TEST-NET-1. The frame is a model of one packet toward gate.
Activity rows. A1, A2, and A3 are the only frames serialized in intro-demo.pcapng.
Frame Offset Ethernet IPv4 TCP
A1 0.000000 desk to shelf 192.168.50.10 to 192.168.50.23 SYN 49152 to 9090
A2 0.000001 shelf to desk 192.168.50.23 to 192.168.50.10 SYN-ACK 9090 to 49152
A3 0.000002 desk to shelf 192.168.50.10 to 192.168.50.23 ACK 49152 to 9090
Absent: a frame that never reached lab0, including a frame between two other hosts.
Predict before reading the check. Check: A2 is shelf 192.168.50.23 and desk 192.168.50.10.
A missing row does not prove that no other packet existed.
Terms for the technical inventory below
Snap length: maximum bytes stored from each packet.
ISN: initial sequence number, where one side starts its TCP numbering.
DF: the IPv4 Do Not Fragment bit, a request not to split that packet
into fragments for forwarding.
TTL: Time to Live, used as a hop budget; a router reduces it when
forwarding so a packet cannot circulate indefinitely.
Frame check sequence (FCS): an error-detection value for a link frame.
Checksum: a calculated error-detection value checked against received
bytes. These checks can detect corruption; they do not authenticate
the sender or encrypt the content.
if_tsresol: the pcapng interface option describing timestamp resolution,
which tells how much time one timestamp unit represents.
How to interpret these supplied files
Synthetic means constructed teaching data, not a live-network recording.
The model tables, stored frames and historical file reads are distinct:
W1 is paper only; intro-demo contains only its three stated TCP frames.
No described listener or echo card is silently added to a stream file.
Historical file-read record, 2026-10-12:
TShark 4.2.2 read the four supplied files. The earlier record reports
three zero-payload setup frames in intro-demo, list/listed in the worked
stream, ask/noted in the activity stream, and keep/kept in the stage
stream. Each application word has one trailing newline. That operation
read constructed bytes; it did not record a network or use the Wireshark
graphical interface. This note does not claim a new file read.
Provenance for the Stage 05 pcapng files. Synthetic bytes. Not a capture.
These files are pcapng blocks built in memory. They do not open a socket, select an interface, or run Wireshark, tcpdump, or tshark.
No if_name option is written. The name lab0 exists only in the lesson text. The file's interface id is 0.
Link type is 1, Ethernet. Snap length is 65535.
There is no if_tsresol option, so the timestamp unit is the specification default of microseconds.
Clock base is 1767225600 seconds, labeled 2026-01-01 00:00:00 UTC. Frame i is base plus i microseconds.
Frames are not padded to 64 bytes and include no frame check sequence.
IPv4 headers have no options, DF is set, and TTL is 64. TCP headers have no options and the window field is 65535.
Header checksums are part of the file as written. The stream payloads were list, listed, ask, noted, keep, and kept, each followed by one newline.
intro-demo.pcapng
Three TCP frames, client ISN 1000, server ISN 5000.
desk 192.168.50.10:49152 and shelf 192.168.50.23:9090.
SYN, SYN-ACK, ACK. No payload. The paper frame W1 is not in this file.
streams-demo.pcapng
Same peers and ports, same initial sequence numbers, then payloads.
desk sends list and a newline. shelf sends listed and a newline.
streams-field.pcapng
desk 192.168.50.10:49160 and shelf 192.168.50.23:9092.
Client ISN 2000, server ISN 8000.
desk sends ask and a newline. shelf sends noted and a newline.
network-observation.pcapng
desk 192.168.50.10:49170 and shelf 192.168.50.23:9090.
Client ISN 3000, server ISN 9000.
desk sends keep and a newline. shelf sends kept and a newline.
The echo card and the listener card are not packets in this file.
MAC values are documentation EUI-48 values: desk 00-00-5E-00-53-10, shelf 00-00-5E-00-53-23.
- Name the capture point and say whether W1 is in the synthetic file.
- For A2, name the IPv4 source and the IPv4 destination.
- Check: A2 is shelf 192.168.50.23 and desk 192.168.50.10.
- Stop. Do not capture traffic. The optional pcapng link contains those same three frames. The printed table supplies the complete reasoning route.
04Optional challenge
Allow about ten extra minutes. Name metadata a capture might still show when application content is encrypted. Addresses, ports and timing can remain visible even when content is unreadable. These synthetic files contain no encrypted application traffic, so this is a statement about possible metadata rather than a decryption result.
05Fresh cases for the checks
Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.
Capture case A: supplied observation tableOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Capture point: local interface petal0. Offsets use the same clock in seconds.
F1 0.040 192.0.2.61:52008 → 192.0.2.62:9024 TCP SYN
F2 0.047 192.0.2.62:9024 → 192.0.2.61:52008 TCP SYN-ACK
F3 0.051 192.0.2.61:52008 → 192.0.2.62:9024 TCP ACK
This table contains only traffic observed at the stated point.
Method example using DIFFERENT records: 1.000 to 1.020 seconds is 0.020 seconds, or 20 milliseconds.
Capture case B: separate placementOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Point elm sees traffic involving elm. Point oak sees traffic involving oak. Neither point is established as observing traffic between unrelated hosts ash and fir. No ash-to-fir row appears at either point.
06Explain your prediction
Optional written self-check: Record capture point, time basis, endpoint direction and the exact row supporting a claim. Explain what the observation cannot see before claiming an event did not occur.
07Common mistakes
If three listed frames look like a complete network history, reread the recording scope. The table describes selected records from one point, and W1 is not part of the file.
If the tiny offsets look like measured network latency, check their provenance. They are constructed timestamps, not live timing observations. Keep the UTC label rather than silently converting it.
If a missing row suggests one certain cause, state what evidence is absent and which recording limits could explain it. Use the table; a new live capture is unnecessary.
References
- draft-ietf-opsawg-pcapng-06
The section header, interface description, and enhanced packet block layouts. This is an Internet-Draft, not an RFC. This lesson follows that block layout. The three frames are the printed handshake and each has tcp.len 0.
- Wireshark User's Guide 5.2: Open Capture Files
File, then Open, reads a saved file. pcapng is a native format and has been the default save format since Wireshark 1.8. The three frames in intro-demo.pcapng match the table and each has tcp.len 0.