It wasn't supposed to be like this. The "Wireshark Lab" was a routine exercise for the new junior analysts. A controlled environment. A safe little network with three virtual machines, a switch, and a firewall. The goal was simple: capture a standard HTTP login, an FTP file transfer, and a DNS query. Basic pattern recognition.
The capture stopped. The torrent of red and black vanished. The packet list went empty. The switch logs showed Client-3 shutting down gracefully, as if nothing had happened. wireshark lab
The most fundamental concept in networking is the TCP 3-Way Handshake. Let's find it in our capture. It wasn't supposed to be like this