Type each command, then press Enter
Working reference and simulation details
The eth0 observation point receives a mirrored training stream of 15 packets. lo receives three loopback packets; any combines both. This does not imply that an ordinary network interface can see every host's traffic. Each live command starts a fresh replay and loops until its matching-packet limit or an interruption. Display timestamps belong to the fixed replay and repeat on subsequent loops; wall-clock playback is compressed.
-c counts matched packets. A valid filter with no matches keeps waiting. Ctrl+C stops it. -w writes a simulated capture and suppresses the normal packet listing; interruption retains any packets already written. -r reads those saved packets offline and applies the new filter. A filter applied while capturing excludes other packets from the saved file.
Live capture requires simulated sudo. Reading the student's saved capture does not. -A shows printable network-layer packet bytes; -X shows them in hexadecimal and ASCII. The packets have constructed IPv4/TCP/UDP headers and fictional payloads. Their teaching record store behaves like a capture file inside this page; it is not an exported binary PCAP. Selected midstream FTP and TLS packets are included without their earlier handshakes. The TLS bytes are an opaque illustrative sample, not a complete decryptable TLS session.
Supported filter grammar: tcp, udp, ip, host, port, src/dst host/port, and/or/not, and parentheses. Options must precede the filter in normal tcpdump usage. In this limited parser, recognized options may also be reordered. An unrecognized option or filter produces a simulation error. Packet counters are simplified to matched packets with zero modeled kernel drops.
Reference: tcpdump manual.
Terminal and saved files
Everything runs inside this HTML file. No real network queries or capture operations occur. All data is fictional. Files and progress exist only for this page session and clear when reset or reloaded. Selecting a mission stops any active operation and retains files and completed steps.
Type help for the supported command subset. ls lists the simulated lab directory, cat reads saved text, pwd shows the working directory, history lists commands, and clear clears only the screen. Tab completes supported commands, options, names, addresses, and existing filenames at the end of the input. Use Escape then Tab to move focus out of the command field, or disable completion. No arbitrary shell execution is modeled.
Optional reference links require an internet connection; the activity itself works offline. This file can be hosted directly through MkDocs.