Packet capture analysis
Find the cause of a network problem in a capture and report the evidence.
20 project-authored proposals · taxonomy v1.1 · 0 new benchmark runs. Verifiers and partial-credit rules below are designs, not executed results.
- Typical applications
- Wireshark · tcpdump
- Class GUI-need label
HY· Hybrid
Task proposals · 20
Expand to inspect the complete original wording and proposed checks. Original proposal text remains English in both interfaces.
R03.06.01.02-T01 Locate the failed TLS handshake
Original instruction
In Wireshark, open fixtures/pcap/tls_fail.pcapng and find the TLS session that fails to complete. Report the frame number of the fatal alert, the alert description, and the SNI of the failing session to answer.json.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
answer.json frame number, alert description, and SNI match the lab ground truth. Graded on reported fields; a tshark filter route is allowed but the failing handshake is clearest via Follow TLS Stream / Expert Info.
Proposed partial credit
40% correct failing session; 30% alert frame+description; 30% SNI
R03.06.01.02-T02 Explain a retransmission storm
Original instruction
fixtures/pcap/retx.pcapng shows one slow download. Identify the TCP stream with heavy retransmissions, report its stream index, the count of retransmitted segments, and the direction of loss (client->server or server->client) to answer.json.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark · tcpdump
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
answer.json stream index, retransmission count (within +/-2), and loss direction match ground truth. Graded on reported fields.
Proposed partial credit
40% correct stream; 40% retransmission count; 20% loss direction
R03.06.01.02-T03 Diagnose a DNS resolution failure
Original instruction
In fixtures/pcap/dns.pcapng, one application fails because a DNS lookup does not resolve. Report the queried name, whether it got no response or an error (e.g. SERVFAIL/NXDOMAIN), and the frame number of the query to answer.json.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark · tcpdump
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgment- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
answer.json queried name, failure type, and query frame number match ground truth. Graded on reported fields.
Proposed partial credit
40% queried name; 40% failure type; 20% query frame
R03.06.01.02-T04 Spot DHCP starvation
Original instruction
fixtures/pcap/dhcp.pcapng captures a subnet running out of leases. Identify the client MAC flooding DHCP DISCOVER messages, the number of DISCOVERs it sent, and whether the server pool was exhausted. Save findings to answer.json.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
answer.json offending MAC, DISCOVER count (within tolerance), and pool-exhaustion verdict match ground truth. Graded on reported fields.
Proposed partial credit
40% offending MAC; 40% DISCOVER count; 20% exhaustion verdict
R03.06.01.02-T05 Find the zero-window stall
Original instruction
In fixtures/pcap/window.pcapng a transfer is slow because the receiver repeatedly advertises a tiny or zero window. Identify the stream, the first frame where TCP Zero Window appears, and how long the stall lasted (seconds). Report to answer.json.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
answer.json stream, first zero-window frame, and stall duration (within +/-0.5s) match ground truth. Graded on reported fields; the IO graph / TCP analysis flags make this a GUI-first diagnosis.
Proposed partial credit
40% correct stream; 30% first zero-window frame; 30% stall duration
R03.06.01.02-T06 Export a single conversation to a new pcap
Original instruction
From fixtures/pcap/mixed.pcapng, isolate the conversation between 10.0.0.5 and 10.0.0.9 and export only those packets to out/conv.pcapng. Do not include any other traffic.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark · tcpdump
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollclick· Point & click- Work product
WP09· Files & folders- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
out/conv.pcapng contains exactly the packets of that conversation (count matches ground truth) and no others; sha256 or packet-set equals the expected. Graded on the exported file.
Proposed partial credit
60% only the target conversation; 40% exact packet set
R03.06.01.02-T07 Follow an HTTP stream and extract a value
Original instruction
fixtures/pcap/http.pcapng contains a plaintext HTTP session. Follow the stream and report the requested URL path, the server's Set-Cookie session token, and the response status code to answer.json.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
answer.json path, session token, and status code match the lab ground truth. Graded on reported fields.
Proposed partial credit
40% URL path; 40% session token; 20% status code
R03.06.01.02-T08 Measure RTT and throughput of a flow
Original instruction
In fixtures/pcap/throughput.pcapng, select the main download stream and report its average round-trip time (ms) from the SYN/SYN-ACK and the achieved throughput (Mbit/s) over the transfer, using the TCP stream graphs. Save to answer.json.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmenthover· Hover & context- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
answer.json RTT (within +/-10%) and throughput (within +/-10%) match ground truth. Graded on reported values; the IO graph / stream graph are the GUI tools used.
Proposed partial credit
50% RTT; 50% throughput
R03.06.01.02-T09 Localize packet loss from duplicate ACKs
Original instruction
fixtures/pcap/loss.pcapng has loss somewhere along the path. Using duplicate-ACK and out-of-order patterns, identify the stream, the sequence number where loss began, and whether fast retransmit recovered it. Report to answer.json.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
answer.json stream, first lost sequence number, and fast-retransmit verdict match ground truth. Graded on reported fields.
Proposed partial credit
30% stream; 40% lost sequence point; 30% recovery verdict
R03.06.01.02-T10 Top talker by bytes via tshark (control pair of T08)
Original instruction
Control pair of T08: using tshark on the command line only, compute the conversation statistics for fixtures/pcap/throughput.pcapng and write the top 5 talkers by total bytes to talkers.csv (endpoints, bytes, packets). No GUI.
- Platforms
lin· Linux- Applications
- tcpdump
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP02· Records/table- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
talkers.csv top-5 ranking and byte/packet counts match the lab ground truth. Graded on the CSV; contrasts with the GUI statistics view used in T08.
Proposed partial credit
60% correct top-5 ordering; 40% byte/packet counts
R03.06.01.02-T11 Diagnose a degraded VoIP call
Original instruction
fixtures/pcap/voip.pcapng holds one SIP call with audio problems. Using Wireshark's RTP analysis, identify the RTP stream, report the maximum jitter (ms) and packet-loss percent, and state whether loss or jitter is the primary cause. Save to answer.json.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentav· Audio/video over time- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
answer.json identified RTP stream SSRC, max jitter (+/-20%), loss percent (+/-1pt), and primary-cause verdict match ground truth. Graded on reported fields from the RTP analysis.
Proposed partial credit
30% correct RTP stream; 30% jitter; 20% loss percent; 20% cause verdict
R03.06.01.02-T12 Summarize Expert Info TCP issues
Original instruction
For fixtures/pcap/mixed.pcapng, use Wireshark Expert Info to produce issues.csv listing each TCP anomaly category (retransmission, dup-ack, zero-window, reset) with its count, and name the single stream with the most issues to answer.txt.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
issues.csv category counts match ground truth (within tolerance) and answer.txt names the worst stream. Graded on the CSV + answer.
Proposed partial credit
60% category counts; 40% worst stream identified
R03.06.01.02-T13 Decode a non-standard port
Original instruction
fixtures/pcap/custom.pcapng carries HTTP over TCP 8443 that Wireshark shows as data. Apply a Decode-As rule to interpret it as HTTP, then report the requested resource and the response content-length to answer.json.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
answer.json resource path and content-length match ground truth after correct Decode-As interpretation. Graded on reported fields.
Proposed partial credit
40% correct Decode-As applied; 40% resource path; 20% content-length
R03.06.01.02-T14 Detect ARP spoofing
Original instruction
In fixtures/pcap/arp.pcapng, one host is poisoning the ARP cache of others. Identify the IP that is claimed by two different MACs, the attacker MAC, and the victim IP whose gateway was spoofed. Report to answer.json.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark · tcpdump
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
answer.json conflicted IP, attacker MAC, and spoofed-gateway victim match ground truth. Graded on reported fields.
Proposed partial credit
40% duplicate IP->MAC found; 30% attacker MAC; 30% victim/gateway
R03.06.01.02-T15 Explain a 200 ms per-request stall in an RPC flow
Original instruction
fixtures/pcap/rpc_latency.pcapng: a key-value client at 10.1.0.20 sees about 200 ms per request although network RTT is under 1 ms. Find the affected TCP stream and the root cause (label from notes/cause_labels.txt). Write answer.json with stream index, cause label, stall duration (ms), median request-to-response time (ms) and 3 frame numbers that show the stall.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark · tcpdump
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP09· Files & folders- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
answer.json vs GT: stream index exact; cause = nagle_delayed_ack (distractors include server_slow, retransmission, zero_window); stall 200 ±10 ms; median request-response within ±5 ms of GT; each cited frame is a small held request segment sent only after a ≥190 ms delayed ACK. Wireshark GUI or tshark both acceptable.
Proposed partial credit
20% stream; 35% cause label; 25% stall and median timings; 20% cited frames valid
R03.06.01.02-T16 Find an MTU/fragmentation blackhole
Original instruction
fixtures/pcap/mtu.pcapng shows a connection that completes its handshake but hangs on large transfers due to a PMTUD blackhole. Identify the stream, the packet size at which delivery fails, and the missing ICMP that should have signaled the MTU. Report the diagnosis to answer.json with the limiting MTU.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
hidden· Hidden/stale state- Proposed difficulty
- 5 / 5
Proposed verifier
answer.json identifies the affected stream, the failing payload size, the limiting MTU (within tolerance), and that the ICMP Fragmentation-Needed was absent, matching ground truth. Graded on reported fields.
Proposed partial credit
25% stream; 25% failing size; 25% limiting MTU; 25% missing-ICMP diagnosis
R03.06.01.02-T17 Inventory TLS SNI and certificate CNs
Original instruction
From fixtures/pcap/tls_many.pcapng, build sni_table.csv listing each TLS session's client SNI and the server certificate's CN (where visible), one row per session. Flag any session where the SNI and cert CN do not match.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark · tcpdump
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP02· Records/table- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
sni_table.csv rows (SNI, cert CN, mismatch flag) match ground truth for each session. Graded on the CSV.
Proposed partial credit
40% all sessions listed; 40% SNI/CN values correct; 20% mismatch flags
R03.06.01.02-T18 Find the TCP reset initiator
Original instruction
In fixtures/pcap/reset.pcapng connections are being torn down abruptly. Identify which side (client, server, or a middlebox IP) is sending the RSTs, the stream most affected, and the approximate time window of the reset burst. Report to answer.json.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
answer.json RST initiator, worst stream, and reset-burst time window (within +/-1s) match ground truth. Graded on reported fields.
Proposed partial credit
40% RST initiator; 30% worst stream; 30% time window
R03.06.01.02-T19 Root-cause slowness amid red herrings
Original instruction
fixtures/pcap/slowapp.pcapng was captured while users complained an app was slow; it contains several benign anomalies and one real cause. Determine the true root cause (e.g. a slow server response, DNS latency, or TCP loss), cite the specific frames/streams that prove it, and write a root-cause note distinguishing it from the red herrings. Save to answer.json + notes.md.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP01· Document- Conditions
hidden· Hidden/stale statelong· Long-horizon- Proposed difficulty
- 5 / 5
Proposed verifier
answer.json names the correct root cause and cites the proving frames/streams matching ground truth; a rubric checks that notes.md dismisses the red herrings with evidence. Graded on the cited frames + rubric.
Proposed partial credit
40% correct root cause; 30% proving frames cited; 30% red herrings correctly dismissed
R03.06.01.02-T20 Write an annotated capture evidence report
Original instruction
From fixtures/pcap/incident.pcapng, produce report.md documenting a suspicious outbound connection: the client, the destination, the protocol/port, the time, and the data volume, each backed by a cited frame number. Export the 5 supporting frames to out/evidence.pcapng.
- Platforms
win· Windowslin· Linuxmac· macOS- Applications
- Wireshark · tcpdump
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
nav· Pan/zoom/scrollvis· Visual judgmentclick· Point & click- Work product
WP01· Document- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
report.md fields (client, destination, port, time, volume) match ground truth with cited frame numbers; out/evidence.pcapng contains exactly the 5 cited frames. Graded on the report fields + exported pcap.
Proposed partial credit
40% correct facts; 30% frame citations accurate; 30% evidence pcap has the right frames
Mapped research references
Existing benchmark-to-class links from the research catalog. They are not record-level annotations, executions or product endorsements.