The first day watching a network
The day is one capture or one flow that you can explain. Who started it, who answered, and how many bytes. Then you stop, or you ask.
One capture or one flow
Pick one file you are allowed to open, or one conversation inside it. Wireshark is the window when you still need to click a field. The network workbench is the print and the logs when the question is already narrow: tcpdump, tshark, or Zeek.
The packet lab puts one ordinary page load in order. Do that before you try to narrate a long capture. You are reading evidence. You are not sending traffic.
What you write down
Write who started the connection, who answered, and how many bytes moved. Add the time the file uses, and the port if the report names one. A port number is a label. It is not a vulnerability. The page for reading a port list says the same thing after a scan.
If the payload is encrypted, say that. Timing, sizes, and the name in the handshake are still notes. Do not invent what was inside.
When you stop and ask
Stop when the next question needs a system the scope does not name, or a capture you were not given. Ask before you open a second file “to see if it is the same thing.” One flow you can hand to someone else is a finished day.
The finding is that note: what you saw, who was on each side, and what you would change, which may be “keep this capture with the ticket.” The network path on the careers page is the longer list. This page is the shape of the day.