Skip to content
CyberEd DZ
Language
Log in Sign up

Reading a Real Capture

In brief

Reading a capture the way an analyst does: one conversation at a time, from handshake to close — the core skill behind every incident investigation.

Objectives

  • Follow a single TCP conversation
  • Identify handshake, data and close
  • Tell the story a capture contains

You have the theory and the tool. Now read a capture the way an analyst does: top-down, following one conversation at a time.

  1. Filter to a single conversation — right-click a packet and "Follow → TCP Stream".
  2. Find the handshake at the start: SYN, SYN-ACK, ACK.
  3. Watch the data flow, then the graceful close: FIN, ACK.
$ tshark -r capture.pcap -Y "http.request" -T fields -e ip.dst -e http.host
93.184.216.34   example.com
93.184.216.34   example.com

Tip

The skill is not memorising fields — it is telling a story: who spoke to whom, in what order, and where it went wrong. Every incident investigation is that skill at scale.

Recap

  • Read a capture one conversation at a time
  • Every flow has a handshake, data and a close
  • Investigation is telling that story at scale