Checkpoint 5: Wireshark Packet Evidence Investigation

Use only the provided GSC synthetic capture:

Download gsc-week17-baseline.pcapng

Do not capture traffic from the school network, public Wi-Fi, classmates, or unrelated systems.

Submit

Your packet-evidence package must include:

• the five-question capture worksheet from Lesson 2;
• one packet evidence card;
• ARP request/reply table;
• packet timeline;
• topology-versus-capture comparison;
• correction of the claim that an ARP request proves an attack;
• analyst summary with question, evidence, mechanism, result, and limitation;
• one screenshot/export showing only the supplied synthetic capture.

Every conclusion must cite a packet number, field, or filter result that supports it.

Defense question

Answer in 3-5 sentences:

What is the strongest claim this capture supports, and what tempting claim can it not prove?

Scoring

This is a teacher-reviewed mastery checkpoint.

The common GSC I rubric scores five areas from 0-4:

• technical accuracy
• evidence quality and reproducibility
• reasoning and trade-offs
• safety and authorization
• communication

Maximum: 20 points.

The Robotnix mastery target is 15/20 or higher with no criterion below 2. If the evidence is incomplete or a claim reaches beyond what the evidence supports, revise and resubmit.