According to the teaching of computer network protocol, this paper presented a set of practice to theory, practice and theory of comparative teaching methods. In this teaching means, the experiment of practice to theory uses VMware workstation software to build the experimental environment, configures virtual computer, and configures the network services on virtual computer. This means uses Wireshark capture software to crawl the web service protocol packets.Through the analysis of protocol packet, understands the working principle and process of network protocols, and has a further understanding of the principle and configuration of network services. For example in DNS, the work designs "services + protocol" experiment, simulates of recursive queries to DNS domain name resolution. Through the Wireshark grabs DNS data packet, analyses of the organizational structure of the packet and the working process of DNS protocol to enhance the students understanding of the DNS network protocol. Experiments show that this method is suitable for the current experimental status of universities, and suitable for students cognitive law. It promotes the student positive, active, happy learning.