This is the NetworkLessons packet capture library: sample pcap files of network protocols, recorded in our own labs with Cisco IOS, FRRouting and VyOS. Every capture comes with a download link and a walkthrough that explains the important fields in each packet and why they’re there.
Each page focuses on one capture: a single packet or a short exchange that shows how something works. There are no long lab setups. You open the pcap in Wireshark, read along, and see the protocol on the wire. If you want the full theory or configuration, every capture links to the matching lesson.
How to use these captures
Download the capture from its page and open it in Wireshark (or tshark, tcpdump, or any tool that reads pcap/pcapng).
Each page lists a display filter to show only the interesting packets.
Fields highlighted in red in the walkthrough are the ones that matter. The rest is shown so you can match the output with your own Wireshark window.
All-zero MACs, 127.0.0.1, a 13 microsecond round trip and the ping timestamp
Frequently asked questions
What is a pcap file?
A pcap (or the newer pcapng) file stores captured network packets exactly as they were on the wire, with a timestamp for each packet. Tools like Wireshark, tshark and tcpdump write and read this format, so you can analyze traffic later or on another computer.
Can I use these captures for training or testing?
Yes. The captures come from isolated lab networks and contain no customer data. They’re useful for learning protocols, preparing for CCNA, CCNP and CCIE exams, and testing parsers, IDS rules or replay tools.
How do I capture packets on Cisco devices myself?
Cisco IOS and IOS XE can capture packets on the device itself with Embedded Packet Capture (EPC). In a virtual lab such as CML or Containerlab, you can capture directly on the links between devices.
