CS KAIROS · LEARNING LIBRARY
M08 · Sniffing · Safe practice
This module uses offline data, self-created inputs or tabletop scenarios. Follow the steps and check the evidence you produce.
Tabletop exercise: visible and unknown
Use synthetic data without starting a capture.
- Write three columns: time, IP address and TLS payload.
- Mark time and address as observed and payload as not decrypted.
- Add one reason the capture point might miss traffic.
Expected result
Observed fields and unknown content are separate; metadata is not treated as document contents.
Check your work
Does a capture with no DNS packets prove the host performed no name resolution?
Finish and clean up
Keep the table; there is no capture file to remove.