Hands-on lab

PCAP Analysis Lab: Practise Wireshark in Your Browser

Practise PCAP analysis in your browser with 10 safe, synthetic captures. Pick a case, read the scenario, then answer guided questions by filtering packets, opening layers and following TCP streams, the way an analyst works in Wireshark. Every case ends with a score and a debrief: what the traffic means and what you would do next.

New to display filters? Build them with the Wireshark Display Filter Builder, then come back. For log-based practice try the DNS Tunneling Detection Lab, and see the SOC analyst handbook for where packet analysis fits in the job. Teaching a group? See PlayCISO for classes.

The cases

10 cases

How a case works

Read the brief: who captured the traffic, where, and what you are asked to find.
Answer 5 to 8 questions. Some ask you to select a packet, some to type a value (an IP, a username, an interval), some to write the display filter that finds the evidence.
Use up to two hints per question if you are stuck. Hints and wrong tries lower that question’s points; after every answer you see the filter an analyst would use.
Finish for your score, grade and a debrief with next steps. Then switch to free play and explore the whole capture.

Why the captures are safe

Synthetic, not captured. Our own script builds every packet from a fixed seed, so the same file comes out every time. No real network, person or company is in them.
Documentation addresses only. Outside hosts use 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 (RFC 5737); inside hosts use private RFC 1918 ranges; names end in .example, .test or example.com; MAC addresses are locally administered.
No live payloads. No malware, no working exploits, no test-virus strings. Encrypted sessions are random bytes shaped like TLS. Credentials are made up.
Real-looking on the wire. IP, TCP and UDP checksums are correct and TCP sessions have proper handshakes and teardowns, so Wireshark shows no errors. Each file lists its SHA-256 so you can check a download.

Frequently asked questions

What is the PCAP Analysis Lab?

A library of 10 synthetic packet captures you analyse in the browser. Each case gives you a scenario, then asks questions you answer by filtering packets, reading layers and following streams, like you would in Wireshark. You get a score out of 100 and a debrief.

Do I need Wireshark installed?

No. The viewer runs in your browser: packet list, detail tree, hex bytes, display filters, conversations, endpoints, protocol hierarchy and Follow TCP Stream. The captures are classic pcap files, so they also open in Wireshark, tshark, Zeek and Security Onion if you download them.

Which Wireshark display filters work?

A practical subset: protocol names (dns, http, tls, arp, tcp, udp, modbus, smb2, dhcp), fields such as ip.addr, tcp.port, tcp.flags.syn, http.request.method, dns.qry.name and frame, the operators == != > < >= <=, contains and in {...}, and && || ! with parentheses. Anything else gets a clear error message.

Are the captures real traffic or real malware?

Neither. PlayCISO generates every capture with its own script from a fixed seed. Addresses come from the documentation ranges in RFC 5737 and the private ranges in RFC 1918, names end in .example or example.com, MAC addresses are locally administered, credentials are made up, and there are no working exploit payloads. Each file has a published SHA-256.

How are the cases organised?

Ten categories, one case each: reconnaissance, cleartext credentials, brute force, DNS tunnelling, web attacks, layer 2 attacks, command and control, exfiltration, lateral movement and OT/ICS. Levels run from 1 (starter) to 5 (expert), two cases per level.

Do I need an account?

You can open the case pages and read the scenario without one. Playing a case uses one of the 3 runs a free account gets across PlayCISO labs and tools; a run is used only when you finish the case. Downloading the capture or the analyst report needs a paid plan.