Real-Time Wireshark Traffic Analysis
Budget: $10 – $30 USD
I need a Wireshark power-user who can jump straight into a live capture session, dissect packets as they flow, and package the results into a concise, well-structured report. The core of the job is to observe my network in real time, save the capture for reference, and explain exactly what is happening at each protocol layer in language that a technically-savvy reader can follow.
Traffic in scope
• HTTP/HTTPS traffic
• ARP and ICMP traffic
• TCP/UDP traffic
What you will do
Start by placing the proper capture filters, then record enough data to illustrate normal and abnormal patterns on the wire. I am particularly interested in the TCP three-way handshake—please call out the SYN, SYN-ACK, and ACK packets with port numbers and sequence/acknowledgement values—plus any resets or retransmissions that appear. For every device you see, map the MAC address to its vendor and note anything unusual. Walk through ARP requests and replies, log ICMP echo traffic, and highlight any latency or error codes.
Deliverables
1. A clean, reader-friendly report (Word or PDF) that walks through your findings, including protocol usage breakdowns and overall insights.
2. Annotated screenshots that show key packets, filters, and statistics so the narrative is easy to follow.
3. A separate TCP flow diagram or written breakdown of at least one full connection, illustrating the handshake and subsequent data exchange.
4. The original .pcap or .pcapng file saved with your display filters intact so I can reproduce every screenshot.
Acceptance criteria
• Report clearly references packet numbers that match the supplied capture file.
• All screenshots are annotated and legible.
• MAC-to-vendor lookups are accurate.
• Filters used for HTTP/HTTPS, ARP, ICMP, and TCP/UDP are documented so I can repeat the process.
If this matches your skill set and you’re confident in packet-level troubleshooting, let’s get started.
Traffic in scope
• HTTP/HTTPS traffic
• ARP and ICMP traffic
• TCP/UDP traffic
What you will do
Start by placing the proper capture filters, then record enough data to illustrate normal and abnormal patterns on the wire. I am particularly interested in the TCP three-way handshake—please call out the SYN, SYN-ACK, and ACK packets with port numbers and sequence/acknowledgement values—plus any resets or retransmissions that appear. For every device you see, map the MAC address to its vendor and note anything unusual. Walk through ARP requests and replies, log ICMP echo traffic, and highlight any latency or error codes.
Deliverables
1. A clean, reader-friendly report (Word or PDF) that walks through your findings, including protocol usage breakdowns and overall insights.
2. Annotated screenshots that show key packets, filters, and statistics so the narrative is easy to follow.
3. A separate TCP flow diagram or written breakdown of at least one full connection, illustrating the handshake and subsequent data exchange.
4. The original .pcap or .pcapng file saved with your display filters intact so I can reproduce every screenshot.
Acceptance criteria
• Report clearly references packet numbers that match the supplied capture file.
• All screenshots are annotated and legible.
• MAC-to-vendor lookups are accurate.
• Filters used for HTTP/HTTPS, ARP, ICMP, and TCP/UDP are documented so I can repeat the process.
If this matches your skill set and you’re confident in packet-level troubleshooting, let’s get started.