R03.06.01.02 · 任务小类

抓包分析

Packet capture analysis

Find the cause of a network problem in a capture and report the evidence.

20 条本项目编写的提案 · 分类 v1.1 · 新增基准运行 0 次。下方验证方式与部分得分规则是设计，不是执行结果。

典型应用: Wireshark · tcpdump
小类 GUI 需求标签: HY · 混合

任务提案 · 20

展开查看完整原文与建议检查方式；两种界面均保留提案英文原文。

R03.06.01.02-T01 Locate the failed TLS handshake

原始指令

In Wireshark, open fixtures/pcap/tls_fail.pcapng and find the TLS session that fails to complete. Report the frame number of the fatal alert, the alert description, and the SNI of the failing session to answer.json.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 3 / 5

建议验证方式

answer.json frame number, alert description, and SNI match the lab ground truth. Graded on reported fields; a tshark filter route is allowed but the failing handshake is clearest via Follow TLS Stream / Expert Info.

建议部分得分

40% correct failing session; 30% alert frame+description; 30% SNI

R03.06.01.02-T02 Explain a retransmission storm

原始指令

fixtures/pcap/retx.pcapng shows one slow download. Identify the TCP stream with heavy retransmissions, report its stream index, the count of retransmitted segments, and the direction of loss (client->server or server->client) to answer.json.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark · tcpdump
交互表面: desk · 桌面 GUI term · 终端
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 3 / 5

建议验证方式

answer.json stream index, retransmission count (within +/-2), and loss direction match ground truth. Graded on reported fields.

建议部分得分

40% correct stream; 40% retransmission count; 20% loss direction

R03.06.01.02-T03 Diagnose a DNS resolution failure

原始指令

In fixtures/pcap/dns.pcapng, one application fails because a DNS lookup does not resolve. Report the queried name, whether it got no response or an error (e.g. SERVFAIL/NXDOMAIN), and the frame number of the query to answer.json.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark · tcpdump
交互表面: desk · 桌面 GUI term · 终端
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 2 / 5

建议验证方式

answer.json queried name, failure type, and query frame number match ground truth. Graded on reported fields.

建议部分得分

40% queried name; 40% failure type; 20% query frame

R03.06.01.02-T04 Spot DHCP starvation

原始指令

fixtures/pcap/dhcp.pcapng captures a subnet running out of leases. Identify the client MAC flooding DHCP DISCOVER messages, the number of DISCOVERs it sent, and whether the server pool was exhausted. Save findings to answer.json.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 3 / 5

建议验证方式

answer.json offending MAC, DISCOVER count (within tolerance), and pool-exhaustion verdict match ground truth. Graded on reported fields.

建议部分得分

40% offending MAC; 40% DISCOVER count; 20% exhaustion verdict

R03.06.01.02-T05 Find the zero-window stall

原始指令

In fixtures/pcap/window.pcapng a transfer is slow because the receiver repeatedly advertises a tiny or zero window. Identify the stream, the first frame where TCP Zero Window appears, and how long the stall lasted (seconds). Report to answer.json.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 4 / 5

建议验证方式

answer.json stream, first zero-window frame, and stall duration (within +/-0.5s) match ground truth. Graded on reported fields; the IO graph / TCP analysis flags make this a GUI-first diagnosis.

建议部分得分

40% correct stream; 30% first zero-window frame; 30% stall duration

R03.06.01.02-T06 Export a single conversation to a new pcap

原始指令

From fixtures/pcap/mixed.pcapng, isolate the conversation between 10.0.0.5 and 10.0.0.9 and export only those packets to out/conv.pcapng. Do not include any other traffic.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark · tcpdump
交互表面: desk · 桌面 GUI term · 终端
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击
工作产物: WP09 · 文件与文件夹
条件: 未声明
提案难度: 2 / 5

建议验证方式

out/conv.pcapng contains exactly the packets of that conversation (count matches ground truth) and no others; sha256 or packet-set equals the expected. Graded on the exported file.

建议部分得分

60% only the target conversation; 40% exact packet set

R03.06.01.02-T07 Follow an HTTP stream and extract a value

原始指令

fixtures/pcap/http.pcapng contains a plaintext HTTP session. Follow the stream and report the requested URL path, the server's Set-Cookie session token, and the response status code to answer.json.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 3 / 5

建议验证方式

answer.json path, session token, and status code match the lab ground truth. Graded on reported fields.

建议部分得分

40% URL path; 40% session token; 20% status code

R03.06.01.02-T08 Measure RTT and throughput of a flow

原始指令

In fixtures/pcap/throughput.pcapng, select the main download stream and report its average round-trip time (ms) from the SYN/SYN-ACK and the achieved throughput (Mbit/s) over the transfer, using the TCP stream graphs. Save to answer.json.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 hover · 悬停与上下文
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 3 / 5

建议验证方式

answer.json RTT (within +/-10%) and throughput (within +/-10%) match ground truth. Graded on reported values; the IO graph / stream graph are the GUI tools used.

建议部分得分

50% RTT; 50% throughput

R03.06.01.02-T09 Localize packet loss from duplicate ACKs

原始指令

fixtures/pcap/loss.pcapng has loss somewhere along the path. Using duplicate-ACK and out-of-order patterns, identify the stream, the sequence number where loss began, and whether fast retransmit recovered it. Report to answer.json.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 4 / 5

建议验证方式

answer.json stream, first lost sequence number, and fast-retransmit verdict match ground truth. Graded on reported fields.

建议部分得分

30% stream; 40% lost sequence point; 30% recovery verdict

R03.06.01.02-T10 Top talker by bytes via tshark (control pair of T08)

原始指令

Control pair of T08: using tshark on the command line only, compute the conversation statistics for fixtures/pcap/throughput.pcapng and write the top 5 talkers by total bytes to talkers.csv (endpoints, bytes, packets). No GUI.

平台: lin · Linux
应用: tcpdump
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP02 · 记录 / 表格
条件: 未声明
提案难度: 2 / 5

建议验证方式

talkers.csv top-5 ranking and byte/packet counts match the lab ground truth. Graded on the CSV; contrasts with the GUI statistics view used in T08.

建议部分得分

60% correct top-5 ordering; 40% byte/packet counts

R03.06.01.02-T11 Diagnose a degraded VoIP call

原始指令

fixtures/pcap/voip.pcapng holds one SIP call with audio problems. Using Wireshark's RTP analysis, identify the RTP stream, report the maximum jitter (ms) and packet-loss percent, and state whether loss or jitter is the primary cause. Save to answer.json.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 av · 音视频时序
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 4 / 5

建议验证方式

answer.json identified RTP stream SSRC, max jitter (+/-20%), loss percent (+/-1pt), and primary-cause verdict match ground truth. Graded on reported fields from the RTP analysis.

建议部分得分

30% correct RTP stream; 30% jitter; 20% loss percent; 20% cause verdict

R03.06.01.02-T12 Summarize Expert Info TCP issues

原始指令

For fixtures/pcap/mixed.pcapng, use Wireshark Expert Info to produce issues.csv listing each TCP anomaly category (retransmission, dup-ack, zero-window, reset) with its count, and name the single stream with the most issues to answer.txt.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 3 / 5

建议验证方式

issues.csv category counts match ground truth (within tolerance) and answer.txt names the worst stream. Graded on the CSV + answer.

建议部分得分

60% category counts; 40% worst stream identified

R03.06.01.02-T13 Decode a non-standard port

原始指令

fixtures/pcap/custom.pcapng carries HTTP over TCP 8443 that Wireshark shows as data. Apply a Decode-As rule to interpret it as HTTP, then report the requested resource and the response content-length to answer.json.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 3 / 5

建议验证方式

answer.json resource path and content-length match ground truth after correct Decode-As interpretation. Graded on reported fields.

建议部分得分

40% correct Decode-As applied; 40% resource path; 20% content-length

R03.06.01.02-T14 Detect ARP spoofing

原始指令

In fixtures/pcap/arp.pcapng, one host is poisoning the ARP cache of others. Identify the IP that is claimed by two different MACs, the attacker MAC, and the victim IP whose gateway was spoofed. Report to answer.json.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark · tcpdump
交互表面: desk · 桌面 GUI term · 终端
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 4 / 5

建议验证方式

answer.json conflicted IP, attacker MAC, and spoofed-gateway victim match ground truth. Graded on reported fields.

建议部分得分

40% duplicate IP->MAC found; 30% attacker MAC; 30% victim/gateway

R03.06.01.02-T15 Explain a 200 ms per-request stall in an RPC flow

原始指令

fixtures/pcap/rpc_latency.pcapng: a key-value client at 10.1.0.20 sees about 200 ms per request although network RTT is under 1 ms. Find the affected TCP stream and the root cause (label from notes/cause_labels.txt). Write answer.json with stream index, cause label, stall duration (ms), median request-to-response time (ms) and 3 frame numbers that show the stall.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark · tcpdump
交互表面: desk · 桌面 GUI term · 终端
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP09 · 文件与文件夹
条件: 未声明
提案难度: 4 / 5

建议验证方式

answer.json vs GT: stream index exact; cause = nagle_delayed_ack (distractors include server_slow, retransmission, zero_window); stall 200 ±10 ms; median request-response within ±5 ms of GT; each cited frame is a small held request segment sent only after a ≥190 ms delayed ACK. Wireshark GUI or tshark both acceptable.

建议部分得分

20% stream; 35% cause label; 25% stall and median timings; 20% cited frames valid

R03.06.01.02-T16 Find an MTU/fragmentation blackhole

原始指令

fixtures/pcap/mtu.pcapng shows a connection that completes its handshake but hangs on large transfers due to a PMTUD blackhole. Identify the stream, the packet size at which delivery fails, and the missing ICMP that should have signaled the MTU. Report the diagnosis to answer.json with the limiting MTU.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP12 · 答案 / 决策
条件: hidden · 隐藏 / 过期状态
提案难度: 5 / 5

建议验证方式

answer.json identifies the affected stream, the failing payload size, the limiting MTU (within tolerance), and that the ICMP Fragmentation-Needed was absent, matching ground truth. Graded on reported fields.

建议部分得分

25% stream; 25% failing size; 25% limiting MTU; 25% missing-ICMP diagnosis

R03.06.01.02-T17 Inventory TLS SNI and certificate CNs

原始指令

From fixtures/pcap/tls_many.pcapng, build sni_table.csv listing each TLS session's client SNI and the server certificate's CN (where visible), one row per session. Flag any session where the SNI and cert CN do not match.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark · tcpdump
交互表面: desk · 桌面 GUI term · 终端
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP02 · 记录 / 表格
条件: 未声明
提案难度: 3 / 5

建议验证方式

sni_table.csv rows (SNI, cert CN, mismatch flag) match ground truth for each session. Graded on the CSV.

建议部分得分

40% all sessions listed; 40% SNI/CN values correct; 20% mismatch flags

R03.06.01.02-T18 Find the TCP reset initiator

原始指令

In fixtures/pcap/reset.pcapng connections are being torn down abruptly. Identify which side (client, server, or a middlebox IP) is sending the RSTs, the stream most affected, and the approximate time window of the reset burst. Report to answer.json.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 3 / 5

建议验证方式

answer.json RST initiator, worst stream, and reset-burst time window (within +/-1s) match ground truth. Graded on reported fields.

建议部分得分

40% RST initiator; 30% worst stream; 30% time window

R03.06.01.02-T19 Root-cause slowness amid red herrings

原始指令

fixtures/pcap/slowapp.pcapng was captured while users complained an app was slow; it contains several benign anomalies and one real cause. Determine the true root cause (e.g. a slow server response, DNS latency, or TCP loss), cite the specific frames/streams that prove it, and write a root-cause note distinguishing it from the red herrings. Save to answer.json + notes.md.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP01 · 文档
条件: hidden · 隐藏 / 过期状态 long · 长流程
提案难度: 5 / 5

建议验证方式

answer.json names the correct root cause and cites the proving frames/streams matching ground truth; a rubric checks that notes.md dismisses the red herrings with evidence. Graded on the cited frames + rubric.

建议部分得分

40% correct root cause; 30% proving frames cited; 30% red herrings correctly dismissed

R03.06.01.02-T20 Write an annotated capture evidence report

原始指令

From fixtures/pcap/incident.pcapng, produce report.md documenting a suspicious outbound connection: the client, the destination, the protocol/port, the time, and the data volume, each backed by a cited frame number. Export the 5 supporting frames to out/evidence.pcapng.

平台: win · Windows lin · Linux mac · macOS
应用: Wireshark · tcpdump
交互表面: desk · 桌面 GUI term · 终端
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: nav · 平移 / 缩放 / 滚动 vis · 视觉判断 click · 指向与点击
工作产物: WP01 · 文档
条件: 未声明
提案难度: 4 / 5

建议验证方式

report.md fields (client, destination, port, time, volume) match ground truth with cited frame numbers; out/evidence.pcapng contains exactly the 5 cited frames. Graded on the report fields + exported pcap.

建议部分得分

40% correct facts; 30% frame citations accurate; 30% evidence pcap has the right frames

已有研究映射

以下沿用研究目录中的基准与小类映射，不是逐题标注、执行记录或产品背书。

Workflow-GYM

同工作流族的小类

R03.06.01.01 网络配置与仿真