Traffic filtering, capture scope, and protocol evidence

Mechanism

Capture filters limit what packets are recorded; display filters choose which recorded packets are shown. Confusing them can permanently exclude needed evidence. A network observation must identify its vantage point, interface, time window, and capture assumptions, especially when routing or encryption limits visibility.

Practical method

Choose the minimum capture scope needed for the lab exchange and preserve a broad enough original capture. Apply display filters during analysis. Check packet loss indicators and conversation completeness. Record interface and filter expressions alongside the result.

capture filter example: tcp port 443
Wireshark display filter example: tcp.port == 443

Interpreting evidence

An empty filtered view may reflect a wrong filter rather than absent traffic. Verify a known control packet and inspect conversation statistics before making absence claims.

Pitfalls and limits

Loopback, VPN, and container interfaces observe different traffic. Hardware offloading can make checksums appear invalid. Promiscuous mode does not defeat switched-network isolation.