NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Forensics
Packet Analysis With Wireshark
Master Wireshark for network forensics. Learn to apply complex display filters, reconstruct TCP streams, and extract hidden payloads from PCAP files.
Room tasks
1What Is Packet Analysis and Why Does It Matter
2Wireshark Filters and Following Streams
3Reconstructing Files from Packet Captures
4Guided Lab: Extracting a Transferred File from a PCAP
Frequently Asked Questions
What are Wireshark display filters?
Display filters narrow captured packets to those matching conditions, such as ip.addr == 10.0.0.5 or http.request. They are essential for finding relevant traffic in large captures.
How do you reconstruct a TCP stream in Wireshark?
Right-click a packet and choose Follow TCP Stream to see the reassembled conversation. From there you can read content, spot commands or export transferred files.
Can Wireshark extract files from a capture?
Yes, for many protocols, using File, Export Objects. This free intermediate Codelivly room shows how to pull evidence from PCAPs and build a network forensic picture.