Filters and protocol fields need different evidence
Packet captures become academic evidence only when the student explains the conversation being observed. A UK lab report should identify endpoints, protocols, sequence or timing where relevant, and the security meaning of the traffic without claiming more than the capture supports.
- Capture scope and interface selection
- Display filters versus capture filters