📡 Packet Capture

Packet capture lets you see exactly what is happening on a network—packet by packet. This skill is essential for CCST exams, network troubleshooting, and real IT/help-desk roles.

🧠 What Is Packet Capture?

• Capturing network packets
• Inspecting headers and payloads
• Analyzing traffic behavior

🛠️ 1️⃣ Wireshark Usage

📌 What Is Wireshark?

Wireshark is a packet analyzer that captures live network traffic and displays packets in a human-readable format.

• ✔ Free
• ✔ Open-source
• ✔ Industry standard

🖥️ Wireshark Interface (Exam Important)

• Packet List Pane (Top): All captured packets (time, source, destination, protocol)
• Packet Details Pane (Middle): Protocol layers (Ethernet, IP, TCP/UDP, HTTP/DNS)
• Packet Bytes Pane (Bottom): Raw data (Hex + ASCII)

▶️ How to Capture Packets (Step-by-Step)

1. Select network interface (Ethernet / Wi-Fi)
2. Click Start (blue shark fin)
3. Generate traffic (open website, ping)
4. Click Stop (red square)

🔍 Filters in Wireshark

🧪 Real-World Example: Website Not Loading

1. Start Wireshark
2. Apply filter: dns
3. Open website

• ❌ No DNS response → DNS issue
• ✔ DNS OK but no HTTP → Web server issue

💾 2️⃣ Saving & Opening .pcap Files

📌 What Is a .pcap File?

A .pcap file stores captured packets so they can be analyzed later or shared.

💾 How to Save a Capture File

1. Stop capture
2. File → Save As
3. Choose location
4. Select .pcap or .pcapng
5. Click Save

    Example file: dns_issue.pcap
      

📂 How to Open a .pcap File

• Method 1: Wireshark → File → Open
• Method 2: Double-click .pcap file

🧪 Cisco Packet Tracer vs Wireshark

• Packet Tracer: Simulation mode (learning)
• Wireshark: Real packet capture (analysis)

🔐 Important Security Note

• Wireshark can capture HTTP passwords
• HTTPS encrypts payload
• Always capture traffic legally and ethically

📊 Packet Capture – Exam-Ready Summary