Network Lab: Build a Network in Packet Tracer or GNS3 and Analyse It with Wireshark

Part of our free Build Your Own Cyber Lab series. Work through it in order, or jump to the part you need.

1. Plan your lab: hardware, hypervisors and safe networking
2. VirtualBox and VMware basics, then Kali, Parrot and Windows 11
3. Beyond VirtualBox: Hyper-V, VMware Workstation and Proxmox
4. Dual boot Kali Linux and Windows safely
5. Ubuntu in your lab: desktop, server, SSH and Docker
6. Active Directory lab with Windows Server
7. Attack-and-defend network: firewall and vulnerable targets
8. Metasploitable 2 and 3: install and first exploits
9. Blue-team lab: Wazuh, Sysmon and Security Onion
10. Android app testing lab: emulator, MobSF, Frida and Burp
11. OT/ICS security lab: OpenPLC, Modbus and an HMI
12. Network lab: build it in Packet Tracer or GNS3, read it in Wireshark (you are here)

You can do this part any time after part 2 - it needs nothing from the others.

The right tool for each job

Wireshark does not build networks - it reads them. You build the network in one tool and inspect it in another:

Packet Tracer has its own built-in Simulation mode that shows packets hop by hop, but you cannot open its traffic in real Wireshark. GNS3 can start a Wireshark capture on any link with a right-click. Start with Packet Tracer if you are new to networking; move to GNS3 when you want real traffic.

Part A: Build a small office network in Packet Tracer

1. Download Packet Tracer from Cisco Networking Academy (create a free account and enrol in the free Packet Tracer starter course to get the download).
2. Build this topology: one router, two switches, four PCs and one server. Connect PCs to switches with copper straight-through cables and the switches to the router.
3. Create two VLANs on the switches - VLAN 10 (Staff) and VLAN 20 (Guest) - and put two PCs in each:

Switch(config)# vlan 10
Switch(config-vlan)# name STAFF
Switch(config)# vlan 20
Switch(config-vlan)# name GUEST
Switch(config)# interface fa0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

4. Route between the VLANs with router-on-a-stick: make the switch-to-router link a trunk (switchport mode trunk) and create a router subinterface per VLAN:

Router(config)# interface g0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0
Router(config)# interface g0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0
Router(config)# interface g0/0
Router(config-if)# no shutdown

5. Add DHCP on the router for each VLAN (ip dhcp pool STAFF, network, default-router) and set the PCs to DHCP.
6. Add a security control: an ACL that stops GUEST reaching STAFF but allows it out to the server.
7. Switch to Simulation mode, send a ping from a Guest PC to a Staff PC, and step through it. Watch ARP happen first, then see the ACL drop the ICMP packet. This is the clearest way to see how VLANs, routing and ACLs actually interact.

Interface names (fa0/1, g0/0) depend on the device models you pick - use show ip interface brief to check.

Part B: The same idea in GNS3 with real traffic

1. Install GNS3 and the GNS3 VM (it runs the heavier devices inside your hypervisor).
2. Add appliances from the GNS3 marketplace: a switch, an open router or firewall image (for example VyOS, or the pfSense/OPNsense VM from part 7), and VPCS or small Linux nodes as hosts. Commercial router images need your own licence.
3. You can also drag in your existing VirtualBox or VMware VMs, so Kali and Windows from part 2 can sit on a GNS3 network.
4. Recreate the two-VLAN office, then right-click any link > Start capture. Wireshark opens and shows live traffic on that link.

Part C: Capturing in your hypervisor lab

You do not need GNS3 to capture lab traffic:

• On a VM itself: install Wireshark (Kali has it already) and capture on its interface.
• VirtualBox: you can record a VM adapter's traffic to a pcap file with VBoxManage modifyvm "VM name" --nictrace1 on --nictracefile1 trace.pcap (while the VM is powered off), then open the file in Wireshark.
• A dedicated sensor: give a monitoring VM an adapter with promiscuous mode: allow all on the segment you want to watch, as in the Security Onion setup in part 9.

Part D: Read the network in Wireshark

Install Wireshark on your host or analyst VM, start a capture, and generate traffic. Use these display filters to find each protocol:

Exercises

1. The handshake: open a web page and find the SYN, SYN-ACK, ACK. Note the sequence numbers.
2. Cleartext credentials: log in to the FTP or Telnet service on Metasploitable 2 (part 8) while capturing. Follow the TCP stream and read the password. Then do the same over SSH and see that you cannot - that is the whole case for encrypted protocols.
3. Spot a scan: run nmap -sS from Kali against a lab host and use Statistics > Conversations to see one source touching many ports.
4. DHCP starvation awareness: watch normal DORA, then read how a rogue DHCP server would change the default gateway, and how DHCP snooping on switches prevents it.
5. Save your evidence: export interesting packets with File > Export Specified Packets and keep a short note for each capture - it is good interview material.

Practise the analysis without building anything in our packet lab and PCAP analysis lab, and design topologies in the network builder.

Keep it legal and contained

Only attack machines you own or have written permission to test. Vulnerable VMs and malware samples belong on an isolated network with no route to your home LAN or the internet, and never expose a deliberately vulnerable machine with a bridged adapter or a port forward.

You have finished the series

You now have IT, Active Directory, web, mobile, OT and network-analysis labs, plus the firewall and SIEM to watch them. Keep adding one technique at a time, document what you learn, and revisit the hands-on labs for guided scenarios.