← Back to my portfolio

RUSSELL EVERSON / PACKET ANALYSIS PRACTICE

Read the packets. Explain the evidence.

I am learning Wireshark on my desktop through guided study and practice. This interactive example explains how I approach name resolution and connectivity troubleshooting.

Educational simulation · Synthetic packets · No live capture

Compare two troubleshooting scenarios

The selector supports only these example filters. It is not a Wireshark filter parser. Select a packet number to inspect its explanation.

Illustrative packet sequence; times are seconds from the start
No.TimeSourceDestinationProtocolInfo

What the evidence shows

Why an unanswered query does not prove the DNS server is down

A capture only shows what was visible at that capture point. An unanswered query may reflect a service issue, packet loss, firewall filtering, a routing problem, or an incomplete capture. Check the client’s DNS configuration, test reachability, and compare captures before identifying a cause.

Reproduce a small exercise in Wireshark

This is a planned practice exercise, not a claim that these exact results were captured in my lab.

  1. Start a capture on the desktop adapter carrying the test traffic. Identify the adapter’s address with ipconfig /all.
  2. Run nslookup example.com and then ping -n 4 1.1.1.1 in a Windows terminal. Ping replies depend on the network allowing ICMP.
  3. Stop the capture. Apply dns to find the lookup, then icmp to inspect echo requests and any replies. Compare DNS transaction IDs and ICMP identifiers and sequence numbers.
  4. If connected to the isolated lab, try nslookup dc01.lab.local 192.168.50.10 and compare the answer with the configured DC01 address. The desktop must have a route to the lab.
  5. Save a short capture and record the adapter, test command, filter, observed response, and conclusion. Review it for personal information before sharing.

ARP requests appear when a needed local MAC address is not cached. For an off-subnet destination, the client resolves its gateway’s MAC address. Capture visibility depends on the selected adapter; a switched network does not automatically expose every device’s traffic.

Capture filters, display filters, and ring buffers

A capture filter controls what is recorded; a display filter controls which recorded packets are shown. Their syntax differs. A ring buffer rotates capture files and can overwrite older files when a file-count limit is reached. It is optional for this short exercise.

Reference: Official Wireshark display-filter guide.