Packet capture basics
Capture responsibly and read the few patterns that solve most problems: handshakes, resets, retransmissions, DNS and ARP.
- Level
- Advanced
- Length
- About 50 minutes
- Contents
- 3 lessons · 1 video · final exam
- Status
- Published · updated 1 Oct 2026
Skills you'll practise
- Decide when a capture is appropriate and get permission
- Recognize the TCP three-way handshake, resets and retransmissions
- Tell 'no response' from 'actively refused' in a capture
- Read DNS and ARP exchanges in capture summaries
Course outline
- 1.Packet capture basicsVideo · 2 min
- 2.Reading a captureLesson · 20 min
- 3.Capture filters and display filters that save timeLesson · 15 min
- 4.Reading ICMP errors and address conflictsLesson · 15 min
- 5.Packet capture basics: knowledge checkKnowledge check · 17 questions
- 6.Packet capture basics: practical exerciseKnowledge check · 1 question
- 7.Final exam8 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- RFC 9293: Transmission Control Protocol (TCP)
- RFC 826: An Ethernet Address Resolution Protocol
- Wireshark User's Guide (capture and display filters)
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.