Skip to content

README.md

Latest commit

 

History

History
106 lines (73 loc) · 2.09 KB

README.md

File metadata and controls

106 lines (73 loc) · 2.09 KB
Raw

Network Traffic Analysis using Wireshark and tcpdump

To capture, analyze, and identify normal and suspicious network traffic using Wireshark and tcpdump in a virtual lab, Linux environment..

Tools Used

  • Wireshark
  • tcpdump
  • Linux (Ubuntu)
  • VirtualBox
  • Nmap

Traffic Analyzed

  • ICMP
  • DNS
  • HTTP vs HTTPS
  • SSH

Wireshark Filters

  • Purpose | Filter
  • ICMP flood |icmp
  • DNS traffic |dns
  • HTTP traffic | http
  • HTTPS |tcp.port == 443
  • Failed logins |tcp.port == 22
  • Specific IP |ip.addr == 192.168.56.101

tcpdump Advanced Filters

sudo tcpdump -i eth0 tcp

Captures all TCP traffic on interface

Shows:

  • HTTP / HTTPS

  • SSH

  • FTP

  • Any TCP-based communication

📌 When to use

✔ General network investigation ✔ Checking if a service is reachable ✔ Identifying suspicious TCP connections

sudo tcpdump -i eth0 port 22

Captures traffic only on port 22, Port 22 = SSH

📌 When to use

✔ Detect SSH login attempts ✔ Brute-force attack investigation ✔ Monitor remote access activity

sudo tcpdump -i eth0 icmp

Captures ping & ICMP traffic

ICMP includes:

  • ping

  • echo request

  • echo reply

📌 When to use

✔ Network connectivity testing ✔ Detect ICMP flooding ✔ Identify scanning or reconnaissance

sudo tcpdump -nn -i eth0

No name resolution, No DNS lookup, No port name conversion( Raw packet visibility) Shows raw IP addresses and port numbers

📌 Why -nn is important

✔ Faster packet capture ✔ Accurate investigation ✔ Avoids misleading name resolution

Capture traffic using tcpdump & Wireshark

ping google.com ssh localhost curl http://example.com

Key Findings

  • ICMP traffic analysis
  • DNS and HTTP traffic inspection
  • Packet capture using tcpdump
  • SSH brute-force attack detection
  • Filtering and identifying suspicious traffic
  • HTTP traffic was visible in plain text.
  • HTTPS traffic was encrypted.
  • Port scanning activity detected using SYN packets.

Key Learnings

  • Packet-level traffic analysis
  • SOC-style investigation approach
  • Hands-on experience with pcap files