Skip to content

Brief-Process.md

Latest commit

 

History

History
246 lines (153 loc) · 3.28 KB

Brief-Process.md

File metadata and controls

246 lines (153 loc) · 3.28 KB
Raw

🔹 Network Traffic Analysis (Wireshark + tcpdump)

🧩 Lab Setup

✅ Requirements

  • Host OS: Windows

  • VM: Ubuntu Linux (VirtualBox / VMware)

  • Tools:

    • Wireshark
    • tcpdump (already installed in Ubuntu)

✅ Network Mode

Set your VM network to:

  • NAT
  • Bridged

🔹 PART 1: Install & Verify Tools (Ubuntu VM)

1️⃣ Update system

sudo apt update && sudo apt upgrade -y

2️⃣ Install Wireshark

sudo apt install wireshark -y

When asked: 👉 “Allow non-superusers to capture packets?” → YES

3️⃣ Add user to wireshark group

sudo usermod -aG wireshark $USER

Then logout & login again

4️⃣ Verify tcpdump

tcpdump --version

🔹 PART 2: Capture Traffic using tcpdump

1️⃣ Identify network interface

ip a

You’ll see something like:

  • eth0 or ens33

2️⃣ Capture ICMP (Ping traffic)

Open Terminal 1:

sudo tcpdump -i eth0 icmp

Open Terminal 2:

ping google.com

👉 ICMP Echo Request & Reply

3️⃣ Capture DNS traffic

sudo tcpdump -i eth0 port 53

In another terminal:

nslookup google.com

DNS query & response

4️⃣ Capture SSH traffic

sudo tcpdump -i eth0 port 22

If SSH not installed:

sudo apt install openssh-server -y
sudo systemctl start ssh

Then:

ssh localhost

TCP handshake

5️⃣ Capture HTTP traffic

sudo tcpdump -i eth0 port 80 -nn

Then:

curl http://example.com

HTTP traffic

6️⃣ Capture HTTPS traffic

sudo tcpdump -i eth0 port 443 -nn

Then:

curl https://google.com

encrypted HTTPS packets

🔹 PART 3: Capture Traffic using Wireshark

1️⃣ Start Wireshark

wireshark

Select: 👉 eth0 / ens33

Click Start Capture

2️⃣ Apply Filters (Very Important)

Traffic Filter
ICMP icmp
DNS dns
HTTP http
HTTPS tcp.port == 443
SSH tcp.port == 22

🔹 PART 4: Detect Suspicious Activity

🔴 Port Scan Detection

Install nmap:

sudo apt install nmap -y

Run scan:

nmap -p 1-1000 localhost

In Wireshark filter:

tcp.flags.syn == 1 and tcp.flags.ack == 0

multiple SYN packets 👉 This is port scanning behavior

🔴 Unusual Traffic Pattern

  • Repeated SYN packets
  • Same source IP hitting multiple ports
  • High packet rate in short time

Write observation like:

“Multiple SYN packets detected from 127.0.0.1 targeting different ports, indicating possible port scanning.”

🔹 PART 5: Documentation (THIS MAKES IT RESUME-READY)

🔹 Create Incident Findings

Write:

  • Protocol analyzed
  • Normal behavior
  • Suspicious behavior
  • SOC conclusion

Network Traffic Analysis using Wireshark & tcpdump • Captured and analyzed ICMP, DNS, HTTP, HTTPS, and SSH traffic to identify normal and suspicious network behavior • Detected port scanning activity using SYN packet analysis • Documented findings with screenshots and SOC-style incident observations