SL-04 — Packet parsing and timestamp validation
Supplemental lab · v23 · complements the Progressive Labs without changing their sequence
Learning objective
Packet parsing and timestamp validation. Produce a documented result that distinguishes content integrity, metadata behavior and the limits of your test.
Prerequisites
Basic hexadecimal and UTC concepts; preserved copies of the two supplied PCAPNG files.
Tools
- Python 3
- xxd or od
- TShark
Lab resources — start here
Open the companion field guide — instructions and worked examples.
Download the student kit (ZIP) — guide, scripts and supporting lab files.
View the Packet Parsing Tool Summary in your browser — all six reference worksheets.
Download the Packet Parsing Tool Summary (MHT) — save the browser archive for offline use.
Browse all labs — Progressive and Supplemental Labs.
Procedure
Download the student kit and identify both supplied captures by the guide’s hashes. Work from verified copies.
Use the guide and browser tool summary to distinguish file/section byte order, protocol byte order and host numeric display.
Locate the section, interface and enhanced packet block using the supplied walkthrough. Record exact offsets and raw bytes; do not reuse offsets for an unrelated capture.
Decode the timestamp high and low words with the section byte order, then apply the interface resolution and offset.
Run the supplied read-only validator and cross-check the packet times against TShark. Retain the command, versions, warnings and output.
Explain any discrepancy and distinguish a correct stored-value conversion from capture-clock accuracy. Submit your own evidence rather than copying expected results.
Submit
Capture hashes; block/interface identification; byte dump; arithmetic and units; validator output; TShark comparison; clock-accuracy limitations.
For each screenshot, include the command, relevant input, complete result and a step label. Keep raw logs with screenshots. Report errors and untested steps explicitly.
Completion criteria
- Correct input scope and recorded environment.
- Commands follow the companion guide and their exit status is explained.
- Content checks and metadata observations are supported by retained evidence.
- Results distinguish observations from expected examples and untested claims.
- The analyst conclusion does not exceed the evidence.