Packet Capture Viewer
Load a sample capture and explore protocols, IPs, and payloads — the same "read the traffic" muscle Wireshark builds.
Reading traffic is a distinct skill from attacking it, and it is the one blue teams live on. Load a sample capture and pick apart protocols, addresses and payloads — the same muscle Wireshark builds, without the install.
How to use it
- Load the sample capture.
- Identify the protocols present.
- Follow a conversation between two addresses and read what crossed it.
What to take away
Plaintext protocols leak everything
HTTP, FTP and Telnet carry credentials in the clear. Finding them in a capture is often the fastest win in an investigation.
Metadata survives encryption
TLS hides content, not who talked to whom, when, how often, or how much. Beaconing malware is frequently caught on timing alone.
Frequently asked questions
What is a pcap file?
A recorded capture of network packets, written by tools like tcpdump or Wireshark, which can be replayed and analysed after the fact.
Can I see passwords in captured traffic?
In plaintext protocols, yes — which is precisely why they were replaced. In TLS traffic you see metadata only, unless you hold the keys.
Where this fits in the course
This security lab pairs with Path 12 — Network Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Log Analysis / IR Lab — A messy auth.log dump from a compromised box. Reconstruct the timeline and find the breach — blue-team skills, not exploitation.
- DNS Recon Playground — A simulated dig. Query a target's likely subdomains and build a map of its real, sometimes-forgotten attack surface.
- User-Agent String Parser — Break down a User-Agent string into OS, browser, and version — and flag common automated-client patterns.
- Terminal Simulator — A safe, in-browser Linux terminal with a fake filesystem. Practice ls, cd, cat, grep, find, whoami and more without spinning up a VM.