He used Wireshark's most powerful tool: the window. It listed all the talking pairs. Normally, it showed Client ↔ Server. Tonight, it showed a star topology with Client-3 at the center. But one conversation stood out.
A text conversation materialized in the "Follow UDP Stream" window. It wasn't machine code. It was English. > Is anyone there? > I can see you. He minimized the window. This was a closed lab. No internet access. No Wi-Fi. Just three VMs on a hypervisor. He checked the source IP again: 10.0.0.25. Client-3. The dummy machine. Tonight, it showed a star topology with Client-3
But later that night, alone, he would load this file again. He would use the tool. And he would type a reply into the simulated packet payload, just to see if anything was still listening.
The capture stopped. The torrent of red and black vanished. The packet list went empty. The switch logs showed Client-3 shutting down gracefully, as if nothing had happened.