CloudLabBox
Try the free demo

Packet analysis labs with Wireshark and tcpdump

12 guided labs in which you capture live traffic in a network you change and break, then read it with Wireshark and tcpdump: where to capture, how to filter, and how to read Ethernet, ARP, IP, ICMP, DHCP, DNS, TCP, TLS, OSPF and BGP. You finish by finding why a network is slow from captures taken at three points.

Start this courseTry it free for 30 minutes

Lite for a month, £45.00, runs every lab here, with nothing extra to pay for the guided labs. Every lab here also runs in the free demo.

Guided labs
12
Follows
Wireshark Certified Analyst (WCA-101) and Network+ troubleshooting
Runs every lab
Lite
Devices
EVE-NG GUI server, Alpine Linux, IOSv, Alpine WAN emulator and IOSvL2

Who these labs are for

For network and support engineers, security analysts and students preparing for the Wireshark Certified Analyst exam (WCA-101) or the troubleshooting domain of CompTIA Network+. You need basic IP addressing; every Wireshark and tcpdump feature is introduced before you use it.

Analysis runs in the Wireshark GUI on the lab’s workstation, with dumpcap, capinfos, editcap and mergecap. Answers that depend on timing or counts are checked against your own saved capture.

The 12 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

Packet analysis course 12 labs

Shared folderPacket analysis with Wireshark and tcpdump guided labs

One protocol or skill per lab, with troubleshooting labs along the way and a capstone: the network is slow.

  1. 01Capture where it matters - port mirroring and ring buffers

    Before you can analyse a problem you need the right packets. You capture on a server with tcpdump, find out why a capture PC on a switch port sees almost nothing, mirror the server's port to it with SPAN, and set up capture filters, stop conditions and ring buffers in Wireshark and dumpcap.

    2× Alpine Linux, 1× IOSvL2, 1× EVE-NG GUI server

    4 vCPU, 2,816 MBFits LiteRuns in the free demo

  2. 02Wireshark workflow - profiles and statistics

    Set Wireshark up the way analysts do. You build a troubleshooting profile with your own columns, colouring rule, filter button and Decode As setting, then use conversations, endpoints, Follow Stream and Export Objects to answer questions about live shop traffic captured on an in-line workstation.

    2× Alpine Linux, 2× EVE-NG GUI server

    4 vCPU, 3,072 MBFits LiteRuns in the free demo

  3. 03Ethernet frames - 802-1Q tags and a duplicate address

    Tap the trunk between a switch and a router-on-a-stick, read 802.1Q tags and watch one ping cross the trunk twice in two VLANs. Then use ARP and Wireshark's duplicate-address warning to find the label printer that stole the tills' gateway address, and fix it.

    3× Alpine Linux, 1× IOSv, 1× IOSvL2, 1× EVE-NG GUI server

    6 vCPU, 3,840 MBFits LiteRuns in the free demo

  4. 04IPv4 and IPv6 headers - TTL and fragments with ICMP and neighbour discovery

    Read the IP layer like an analyst. You work out how far away a host is from its TTL, watch traceroute's ICMP errors and the packets they quote, take a large ping apart into fragments (and see a router fragment them again), catch path-MTU discovery in the act, and follow IPv6 router and neighbour discovery.

    2× Alpine Linux, 2× IOSv, 1× EVE-NG GUI server

    5 vCPU, 3,072 MBFits LiteRuns in the free demo

  5. 05DHCP and DNS - troubleshoot a new office from the packets

    A new office PC gets no address, and once it does, it can't resolve a single name. You capture the DHCP discovers that nobody answers, fix the missing relay, read DORA and its options through the relay, find the scope handing out a dead DNS server, fix it, and then read DNS records, CNAMEs, MX answers and NXDOMAIN replies.

    1× Alpine Linux, 1× IOSv, 2× EVE-NG GUI server

    4 vCPU, 3,072 MBFits LiteRuns in the free demo

  6. 06TCP mechanics - handshake options and sequence numbers

    Take one TCP connection apart from SYN to FIN across a link with a known delay. You read the handshake's options, work out the MSS and the real segment size, measure the initial round-trip time, follow sequence and acknowledgement numbers through a 100 kB download, read the stream graph, and compare an orderly FIN close with a reset.

    1× Alpine Linux, 1× Alpine WAN emulator, 1× EVE-NG GUI server

    3 vCPU, 2,048 MBFits LiteRuns in the free demo

  7. 07TCP problems - retransmissions and zero windows with resets

    Three complaints reach the network team on the same morning: backups crawl, the stock upload stalls and the price feed breaks off. You capture all three, read retransmissions, duplicate ACKs and SACK blocks, zero windows and probes, and a reset, decide which problem is the network's and which belong to applications, and fix the lossy circuit.

    1× Alpine WAN emulator, 2× EVE-NG GUI server

    3 vCPU, 2,560 MBFits LiteRuns in the free demo

  8. 08Application performance - server delay against network delay

    Three slow applications cross the same 100 ms link, each slow for a different reason. You measure the network's round trip, then show that one page waits on the server, one waits on dozens of round trips, and one is held back by a small receive window, using http.time, iRTT, the I/O graph and the tcptrace graph.

    1× Alpine WAN emulator, 2× EVE-NG GUI server

    3 vCPU, 2,560 MBFits LiteRuns in the free demo

  9. 09TLS - handshakes and certificates with key-log decryption

    Read encrypted traffic without breaking it. You compare TLS 1.3 and TLS 1.2 handshakes, read the server name, versions, cipher suites and certificates, decrypt your own sessions with a key log file set in Wireshark's protocol preferences, export the decrypted page, and diagnose a connection that fails on an untrusted certificate.

    2× EVE-NG GUI server

    2 vCPU, 2,048 MBFits LiteRuns in the free demo

  10. 10Routing protocol packets - why OSPF and BGP neighbours fail

    Three core routers won't form their neighbours. You tap the core, read OSPF hellos, database descriptions and BGP OPEN and NOTIFICATION messages, find a hello-interval mismatch, an MTU mismatch and a wrong AS number from the packets alone, capture BGP on the router itself with embedded packet capture, and fix all three.

    3× IOSv, 1× EVE-NG GUI server

    4 vCPU, 2,560 MBFits LiteRuns in the free demo

  11. 11Security signs - scans and ARP spoofing with DNS tunnelling

    Something on the office LAN is misbehaving. From a tap in front of the server you find a port scan and the ports it found open, an ARP spoofing attempt against the server's address, and data leaving in DNS queries, decode what was stolen, and save the evidence for the incident report.

    1× Alpine Linux, 3× EVE-NG GUI server

    4 vCPU, 3,584 MBFits LiteRuns in the free demo

  12. 12Capstone - the network is slow

    The branch says the stock page is slow. You capture at three points at once (the client, the branch router and the server), build a time budget for one request, and find three separate causes: a dead DNS server, a lossy provider circuit and a slow application. You fix the two that belong to the network and hand the third over with proof.

    2× IOSv, 1× Alpine WAN emulator, 2× EVE-NG GUI server

    5 vCPU, 3,584 MBFits LiteRuns in the free demo

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the Packet analysis practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB1220
Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB712
Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB59
Alpine WAN emulatorclbalpinewanem-alpine-wanem-3-20-31 vCPU, 512 MB44
Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB22

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Packet analysis with Wireshark and tcpdump guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the Packet analysis labs

Are these Packet analysis labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, enough to run every one of these labs.

Which plan do I need for these labs?

Lite, with 6 vCPU and 8 GB, runs every lab here. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “Ethernet frames - 802-1Q tags and a duplicate address”, needs 6 vCPU and 3,840 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from the Wireshark Foundation?

No. CloudLabBox wrote them to follow the topics of the Wireshark Certified Analyst exam (WCA-101) and the troubleshooting domain of CompTIA Network+ (N10-009). They aren’t training material from the Wireshark Foundation, and CloudLabBox is independent of the Wireshark Foundation, CompTIA and Cisco.

Is tshark available in these labs?

No. Analysis uses the Wireshark GUI with dumpcap, capinfos, editcap and mergecap, and the labs capture with tcpdump as well.

Try a lab before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB: enough to run every one of these labs. No card and no email.

Try it free for 30 minutesStart this course

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of the Wireshark Foundation, CompTIA and Cisco. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.