Network Packet Lab Skill
Guide safe, educational packet capture labs and capture interpretation. Focus on what the packet shows, why it appears, and how it proves the protocol mechanism.
When To Use
Use this skill for:
- explaining a Wireshark screenshot, exported text, CSV, or pcap summary;
- designing labs for DNS lookup, TCP handshake, HTTP request/response, DHCP, ARP, ICMP ping, TLS handshake, routing path, NAT observation;
- writing lab reports from user-provided observations;
- diagnosing learning-level connectivity problems such as DNS failure, wrong gateway, closed port, retransmission, or MTU symptoms.
Safety Boundary
- Keep the work educational and defensive.
- Do not provide instructions for unauthorized scanning, exploitation, credential capture, session hijacking, bypassing security controls, or stealth.
- If a lab involves a live network, tell the user to use their own device, local VM, school lab environment, or explicitly authorized network.
Capture Analysis Workflow
- Identify the protocol and layer.
- Extract key fields: endpoints, ports, sequence/ack numbers, flags, TTL, IDs, query names, status codes, certificates, or options.
- Reconstruct the timeline.
- Explain what each packet proves.
- Tie the observation back to the concept.
- Produce a lab report or visual summary if useful.
Lab Report Template
# [Protocol] Packet Capture Lab
## Objective
[What concept the lab proves.]
## Environment
- Client:
- Server:
- Tool:
- Filter:
## Procedure
1. ...
## Key Observations
| Step | Packet/Field | Meaning |
|---|---|---|
## Protocol Explanation
[Explain the mechanism shown by the capture.]
## Common Errors
- ...
## Conclusion
[What the student should remember.]
Helpful Display Filters
Give filters as learning aids, not as attack instructions:
- DNS:
dns
- TCP handshake:
tcp.flags.syn == 1 || tcp.flags.ack == 1
- HTTP:
http
- TLS:
tls
- DHCP:
bootp
- ARP:
arp
- ICMP:
icmp
Coordination
- Use
network-protocol-viz to turn the reconstructed packet timeline into an HTML animation.
- Use
computer-network-learning to explain prerequisite concepts.
- Use
network-exam-practice to turn the lab into questions after the explanation.
1---2name: network-packet-lab3description: Use this skill whenever the user asks about Wireshark, tcpdump, packet capture, pcap analysis, HTTP/DNS/TCP/DHCP/TLS capture interpretation, network lab reports, protocol fields observed in packets, or troubleshooting packet flows for learning and coursework.4---56# Network Packet Lab Skill78Guide safe, educational packet capture labs and capture interpretation. Focus on what the packet shows, why it appears, and how it proves the protocol mechanism.910## When To Use1112Use this skill for:1314- explaining a Wireshark screenshot, exported text, CSV, or pcap summary;15- designing labs for DNS lookup, TCP handshake, HTTP request/response, DHCP, ARP, ICMP ping, TLS handshake, routing path, NAT observation;16- writing lab reports from user-provided observations;17- diagnosing learning-level connectivity problems such as DNS failure, wrong gateway, closed port, retransmission, or MTU symptoms.1819## Safety Boundary2021- Keep the work educational and defensive.22- Do not provide instructions for unauthorized scanning, exploitation, credential capture, session hijacking, bypassing security controls, or stealth.23- If a lab involves a live network, tell the user to use their own device, local VM, school lab environment, or explicitly authorized network.2425## Capture Analysis Workflow26271. Identify the protocol and layer.282. Extract key fields: endpoints, ports, sequence/ack numbers, flags, TTL, IDs, query names, status codes, certificates, or options.293. Reconstruct the timeline.304. Explain what each packet proves.315. Tie the observation back to the concept.326. Produce a lab report or visual summary if useful.3334## Lab Report Template3536```markdown37# [Protocol] Packet Capture Lab3839## Objective40[What concept the lab proves.]4142## Environment43- Client:44- Server:45- Tool:46- Filter:4748## Procedure491. ...5051## Key Observations52| Step | Packet/Field | Meaning |53|---|---|---|5455## Protocol Explanation56[Explain the mechanism shown by the capture.]5758## Common Errors59- ...6061## Conclusion62[What the student should remember.]63```6465## Helpful Display Filters6667Give filters as learning aids, not as attack instructions:6869- DNS: `dns`70- TCP handshake: `tcp.flags.syn == 1 || tcp.flags.ack == 1`71- HTTP: `http`72- TLS: `tls`73- DHCP: `bootp`74- ARP: `arp`75- ICMP: `icmp`7677## Coordination7879- Use `network-protocol-viz` to turn the reconstructed packet timeline into an HTML animation.80- Use `computer-network-learning` to explain prerequisite concepts.81- Use `network-exam-practice` to turn the lab into questions after the explanation.
mingchen666