What this capture can see

One interface, one view

Wireshark records frames that arrive at the interface you select. On a lab virtual machine that interface is usually the virtual NIC of that guest. You see conversations the guest sends and receives, plus broadcasts that reach it. A switched lab network does not pour every other guest’s traffic onto that NIC just because promiscuous mode is ticked.

Promiscuous mode asks the NIC to keep frames that are not addressed to it. A switch still chooses which frames to forward down the cable. The useful question is physical: where was the capture taken, and which path had to pass that point? Write the interface name, the host, and the time zone into the notes before you interpret a single row.

A mirror is a copy, with its own failures

On a network you administer, a span or mirror port copies frames from chosen switch ports to the port where the capture machine sits. That copy is how a defender sees traffic that never terminated on the capture host. It is still a copy. An oversubscribed mirror drops frames, and a one-direction mirror shows only one way of a conversation. Both look, in the file, like the network itself misbehaved.

Some NICs strip an 802.1Q tag before the capture API sees the frame, or they offload checksums and segmentation. Those are properties of the capture path. A missing VLAN tag in a host capture is a weak reason to claim the packet was untagged on the wire. The capture-point note is what lets a second person judge that.

Worked case: the server never answered, or you never saw the answer

You have a file taken on the lab client 10.8.0.40. It sends a TCP SYN to 10.8.0.20 port 443 and nothing comes back. From this file alone you can say the client sent a SYN and this interface did not observe a SYN-ACK. You cannot yet say the server ignored it. The reply could have been dropped on the path, or sent on a path this NIC does not see.

A second file, taken on the server at the same time, either contains the SYN or it does not. If the server file has the SYN and a SYN-ACK, the reply existed and the client’s capture missed it. If the server file has no SYN, the packet never reached that interface. Two capture points answer a question that one capture point can only pose.

ip.addr == 10.8.0.20 && tcp.port == 443 && tcp.flags.syn == 1

What you write down before the analysis

Treat the capture point as part of the evidence. Interface, host, whether the file is a mirror, the capture filter if one was set, the snap length if it was shortened, and the clock. A capture filter that kept only port 53 means the absence of HTTP in that file is your filter, not a property of the host.

Capture on the lab, on interfaces you are allowed to record. A production span is a production access. The same authorization you would need to read those conversations applies to recording them, and the file is full of metadata even when the payloads are encrypted.

• Host and interface name.
• Mirror or local NIC.
• Capture filter and snap length, if any.
• Clock and time zone of the capture machine.