Week 17: ARP and Wireshark Packet Analysis

This week makes local network behavior visible.

Garden State Cyber I specifically includes ARP and Wireshark. Robotnix keeps the activity safe by using teacher-provided synthetic packet captures instead of live school-network capture.

This week

Lesson 1: ARP: How a Local Network Finds the Next Interface

Connect IPv4 addresses to local MAC delivery, read synthetic ARP tables, and distinguish local destination resolution from routing toward a remote network.

Lesson 2: Wireshark: Read a Capture Without Touching the Network

Open supplied captures, use bounded display filters, inspect protocol layers, build packet evidence cards, and answer specific questions from recorded traffic.

Lesson 3: ARP and Wireshark Lab: Reconstruct the Local Conversation

Use packet numbers to reconstruct an ARP request/reply and the traffic that follows. Compare predicted topology with observed capture evidence.

What you will produce

• ARP sequence diagrams
• capture-analysis worksheet
• packet evidence card
• ARP request/reply table
• packet timeline
• topology-versus-capture comparison
• analyst summary

The standard is:

Explain why normal protocol traffic exists before calling it suspicious, and support every packet claim with an exact field or packet number.