Network Security Lab

Wireshark: Seeing What the Network Sees

Wireshark is the world's most popular packet analyser. It captures traffic from a network interface (or opens a saved .pcap file) and shows every packet in detail. Network engineers use it to fix problems, and security analysts use it to investigate attacks.

In this lab you will work with a simulated capture from a small office network. No real traffic is captured. Your job is to act as an analyst and find four things hidden in the data.

Legal note: Only capture traffic on networks you own or have written permission to monitor. Capturing other people's traffic without permission is illegal in many places, including under Nigeria's Cybercrimes Act 2015.

---

The Wireshark Window

Colours help: in real Wireshark, TCP, DNS, HTTP and ARP each have their own colour, and packets with problems are highlighted.

---

Display Filters You Should Know

You can combine them with && (and) and || (or). For example: ip.addr == 192.168.1.66 && tcp.flags.syn == 1.

Follow TCP Stream rebuilds a whole conversation in reading order. It is the fastest way to see exactly what was said in a clear-text session.

---

What Attacks Look Like in a Capture

• Phishing / DNS oddities: a lookup for a lookalike domain such as bank-verify-login.com followed by a connection to an unfamiliar IP.
• Clear-text credentials: FTP, Telnet and HTTP forms show usernames and passwords right in the packet data.
• ARP poisoning: two different MAC addresses claiming the same IP, and Wireshark warning duplicate use of x.x.x.x detected.
• Port scan: one source sending many SYN packets to many different ports in a short time. Open ports answer with SYN-ACK and closed ones with RST.

These are the same attacks you studied in the networking lessons, now seen from the defender's chair.

---

Your Mission

Use the lab on the right. Apply filters, click packets, and use Follow stream. Answer the four questions at the bottom.

1. Which lookalike domain did 192.168.1.24 look up? (Hint: try the dns filter.)
2. What FTP password was sent in clear text? (Hint: ftp or frame contains "PASS", then Follow stream.)
3. Which MAC address is falsely claiming to be the gateway 192.168.1.1? (Hint: arp, and compare the two replies.)
4. Which IP address is port-scanning 192.168.1.50? (Hint: tcp.flags.syn == 1, and see who sends to many ports.)

---

After the Lab: Write Your Findings

A good analyst does not stop at "I found it". For each finding write:

• What you saw (the evidence: packet numbers and filters).
• Why it matters (impact).
• What to do (recommendation).

Example: Packets 17 and 19 show an FTP login in clear text (user tunde). Anyone on the network can capture it. Replace FTP with SFTP, and change the password now. You will use this same structure in penetration test reports in Module 6.

---

Continue Practising

Install Wireshark free from wireshark.org and try the sample captures on the Wireshark wiki, or the malware-traffic-analysis.net exercises. TryHackMe and Blue Team Labs Online have guided packet analysis rooms.