Skip to main content

Preview build: sign-in and grading run on the server. MFA is not enabled, and storage is in server memory so it does not survive a restart.

LearnDefend
Create account
Packet Analysis Foundations
TheoryBeginner9 minNetwork Analysis

The Packet-Analysis Workspace

What is it?

The workspace has three linked areas: a packet list (one row per packet), a details pane (the selected packet's layers), and a bytes/payload view.

Why it matters

The layout is the same whether you use Wireshark or LearnDefend's browser workspace. Learn the layout once and every capture reads the same way.

Where you see it

You will use exactly this layout in the Module 4 browser lab: a display filter on top, the packet table, then details and stream views below.

What normal looks like

You select a row, the details pane updates to that packet's layers, and the columns (No., Time, Source, Destination, Protocol, Info) summarise each packet at a glance.

What suspicious looks like

At the workspace level nothing is suspicious yet — the workspace just presents the data. Suspicion comes from what you read once you filter and inspect.

How analysts investigate

Scan the packet list top to bottom for the Protocol and Info columns, select anything interesting, and read its details — then filter to see only that kind of traffic.

Common beginner mistakes

  • Ignoring the Info column, which already summarises the DNS query, HTTP request or TCP flags for you.
  • Forgetting that the details pane always reflects the currently selected packet, not the whole capture.

The workspace is designed so three views stay in sync. The packet list is your index; the details pane is the full text of the selected packet; the bytes view is the raw payload. Selecting a row drives the other two.

  [ Display Filter: ______________________ ] Apply
  +------------------------------------------------+
  | No | Time | Source | Dest | Proto | Info       |  <- packet list
  |  1 | ...  | ...    | ...  | DNS   | query ...  |
  |  2 | ...  | ...    | ...  | HTTP  | GET /...   |  <- selected
  +------------------------------------------------+
  | v Ethernet / v IP / v TCP / v HTTP             |  <- details
  +------------------------------------------------+
  | 47 45 54 20 2f ...  GET /...                   |  <- bytes
  +------------------------------------------------+
Three linked views: the list you scan, the details of the selected packet, and its raw bytes.

Sign in to save your progress on the server.