The capture point determines visibility
Packet analysis tools show timing, addresses, protocols and decodable content. They observe packets delivered to the capture interface, not an entire network. Switching, mirroring, filters and packet loss can limit visibility.
Capture can collect sensitive data, so determine scope, authorization, retention and sharing in advance. This unit uses synthetic summaries rather than capturing other people’s traffic.
Further reading: Wireshark User’s Guide: Introduction
Visible metadata is not decrypted content
TLS protects communication between endpoints. A passive observer generally still sees some connection information, such as IP addresses, timing and packet sizes. Visibility of names and other details depends on protocol and configuration. Seeing encrypted packets does not mean reading passwords or full application content.
Encryption does not establish that an endpoint is trustworthy. A user may transmit data to a malicious site over a correctly encrypted connection. Transport protection, peer identity and application authorization need separate checks.
Further reading: MDN: Transport Layer Security
Example: only sizes and times are visible
A synthetic record contains a TLS connection at 12:00:00 and three packet sizes, without decrypted data or application logs.
You can describe timing and observed sizes, but cannot directly claim a particular document was uploaded. Contents and action type require additional authorized evidence.
Conclusion: Mark application content unknown and retain the capture location and conditions.
Tabletop exercise: visible and unknown
Use synthetic data without starting a capture.
- Write three columns: time, IP address and TLS payload.
- Mark time and address as observed and payload as not decrypted.
- Add one reason the capture point might miss traffic.
Expected result
Observed fields and unknown content are separate; metadata is not treated as document contents.
Check your work
Does a capture with no DNS packets prove the host performed no name resolution?
Finish and clean up
Keep the table; there is no capture file to remove.