Chapter-02 Cryptography and Network Analysis

1. Introduction to Cryptography

Cryptography is basically the art and science of keeping information from getting snooped
on or tampered with. Humans invented it because everyone keeps trying to spy on everyone
else, and computers just made the whole mess bigger.

Cryptography is the practice and study of securing communications and information using
mathematical techniques to make it unintelligible to unauthorized parties. It involves
transforming data into an unreadable format (ciphertext) through encryption and then
returning it to its original form (plaintext) using a key, ensuring confidentiality, integrity, and
authentication. Key applications include protecting online transactions, emails, and data
privacy.

What cryptography actually is:

A collection of mathematical techniques that let you protect data: hide it, prove it’s
authentic, make sure it hasn’t been altered, and control who can access it.

Why cryptography exists

Because networks are noisy, hostile places. When information moves from point A to B,
there’s absolutely nothing stopping someone from intercepting it. Cryptography gives you
three core guarantees:

• Confidentiality: No one reads your data except the intended person.

• Integrity: No one can modify data silently.

• Authentication: You can confirm the other side is actually who they claim to be.

• Non-repudiation: Someone can’t deny an action they cryptographically signed.

PREPARE BY JAY GOSWAMI 1

Chapter-02 Cryptography and Network Analysis

Importance in cybersecurity
Cryptography isn’t optional in cybersecurity; it’s the backbone holding the entire security
ecosystem together. Without it, every network would basically be an open mic night for
attackers.

Overall judgment: The importance of cryptography in cybersecurity is fundamental. Without

it, confidentiality, integrity, authentication, and trust would collapse.

Key reasons cryptography is essential

• Protects confidentiality

o Prevents unauthorized access to sensitive data during storage or

transmission.

o Shields everything from passwords to financial transactions to personal

messages.

o Without encryption, attackers can literally read network packets in plain text.

• Ensures data integrity

o Hashing and digital signatures make tampering detectable.

o Protects software updates, logs, backups, and communication channels from

silent manipulation.

o Prevents subtle attacks like data poisoning and MITM modifications.

• Enables authentication

o Confirms the identity of users, servers, and systems.

o Powers login systems, multi-factor authentication, SSL certificates, and SSH.

o Stops attackers from impersonating legitimate entities.

• Provides non-repudiation

o Digital signatures ensure actions cannot be denied later.

o Required for legal documents, financial transactions, forensic logging, and

secure email.

• Secures network communication

o TLS, IPSec, SSH, VPNs all rely on cryptography.

PREPARE BY JAY GOSWAMI 2

Chapter-02 Cryptography and Network Analysis

o Without it, the internet as you know it would not be usable for anything
sensitive.

o Prevents eavesdropping, MITM, spoofing, and session hijacking.

• Protects stored data

o Disk encryption prevents data exposure after theft or unauthorized access.

o Database-level encryption limits insider threats.

o Essential for compliance: GDPR, HIPAA, PCI DSS.

• Builds trust in digital systems

o PKI and certificates enable browsers, apps, and servers to trust each other.

o Prevents malicious spoofed sites, fake software, and forged emails.

o Forms the basis of secure digital identity.

• Supports secure access control

o Tokens, API keys, cookies, JWTs all use cryptographic primitives.

o Ensures only authorized parties can access systems or data.

• Enables privacy in modern technologies

o End-to-end encryption keeps messaging apps safe.

o Zero-knowledge proofs and privacy coins rely on advanced crypto.

o Protects user data from corporations, governments, and attackers.

• Critical for emerging fields

o Cloud computing: encryption everywhere, key management services.

o IoT security: device authentication and secure OTA updates.

o Blockchain: hashing, signatures, consensus protocols.

PREPARE BY JAY GOSWAMI 3

Chapter-02 Cryptography and Network Analysis

Encryption
Encryption is the part of cryptography that actually scrambles data so nobody can make
sense of it unless they’re supposed to.

What encryption really is

A mathematical transformation that turns plaintext (readable data) into ciphertext

(unreadable junk) using a key.
Only someone with the correct key can turn the junk back into something meaningful.

Encryption is the process of converting readable data into an unreadable format, called
ciphertext, to protect it from unauthorized access. This is done using an algorithm and a
secret key, and the original data, or plaintext, can only be restored through a process called
decryption, which requires the correct key. Encryption is used to secure data both when it is
stored (at rest) and when it is being transmitted across networks.

How it works:

Encryption uses a mathematical formula called an algorithm to scramble data.

The role of the key:

A cryptographic key is a secret set of values that is used by the algorithm to scramble and
unscramble the data. Without the correct key, the encrypted data remains indecipherable.

Decryption:

To read the data again, the recipient must use the same or a corresponding key to decrypt it,
converting it back to its original plaintext form.

PREPARE BY JAY GOSWAMI 4

Chapter-02 Cryptography and Network Analysis

Core Components of Encryption

1. Plaintext

The original data. Could be:

• Text

• Passwords

• Files

• Network packets

2. Ciphertext

Looks like random garbage. Should reveal absolutely nothing about the original information.

3. Key

A large number used in the encryption algorithm.

If the key is weak or leaked, the entire system collapses.

4. Algorithm (Cipher)

A public mathematical method that uses the key to convert plaintext to ciphertext.
Security depends on the key, not on “hiding the algorithm.”

PREPARE BY JAY GOSWAMI 5

Chapter-02 Cryptography and Network Analysis

Types of Encryptions
1 Symmetric Encryption
Symmetric encryption is the simple, no-nonsense branch of cryptography where everyone
shares one single key to both lock and unlock the data. Humans like it because it’s fast,
efficient, and doesn’t fry their CPUs the way asymmetric crypto does.

Symmetric encryption uses a single, secret key to both encrypt and decrypt data, making it
a fast and efficient method for securing large amounts of data. The primary challenge is
securely distributing the shared key between the sender and recipient, as a compromised
key would allow unauthorized access to all encrypted data.

What Symmetric Encryption Actually Is

A method where the same secret key is used for:

• Encrypting plaintext into ciphertext

• Decrypting ciphertext back into plaintext

If that key leaks, game over. Anyone holding it can read everything.

How It Works (The Actual Flow)

1. You take plaintext.

2. You feed it into the encryption algorithm along with the secret key.

3. Out comes ciphertext that looks like digital trash.

4. Someone with the same key reverses the process.

PREPARE BY JAY GOSWAMI 6

Chapter-02 Cryptography and Network Analysis

Core Components

1. Secret Key

• Typically 128, 192, or 256 bits.

• Must be random and kept hidden.

• If reused incorrectly or sent in plaintext, you might as well not encrypt at all.

2. Cipher(Algorithm)

The mathematical algorithm that does the scrambling.

The most important modern one:

• AES (Advanced Encryption Standard)

o AES-128, AES-192, AES-256

o Fast, strong, hardware-accelerated

Legacy options (aka "retirement home residents"):

• DES (broken)

• 3DES (slow, phased out)

3. IV/Nonce (Initialization Vector)

Used in many modes to make sure repeated messages don’t produce identical ciphertexts.
If you mess this part up, attackers will eat your system alive.

PREPARE BY JAY GOSWAMI 7

Chapter-02 Cryptography and Network Analysis

Advantages

• Speed and efficiency: Its performance makes it ideal for high-volume data processing
where speed is critical.

• Simplicity: It is a simpler and more readily deployable form of security compared to

asymmetric encryption.

Disadvantages

• Key distribution: The biggest challenge is securely sharing the single key with the
intended recipient. If the key is intercepted, the security of the data is compromised.

• Lack of non-repudiation: Because both parties use the same key, it is difficult to
prove which party originally created the message.

• Key management: As the number of users increases, the number of keys required
grows significantly, making management complex

PREPARE BY JAY GOSWAMI 8

Chapter-02 Cryptography and Network Analysis

2 Asymmetric Encryption
Asymmetric encryption is the fancy, heavyweight side of cryptography where you don’t have
to play “secret key courier” like it’s the 1990s. It solves the annoying key-sharing problem
that symmetric encryption can’t handle gracefully.

Asymmetric encryption, also known as public-key cryptography, is a method of securing

communication that uses a pair of mathematically linked keys: a public key and a private
key. The public key can be freely shared, while the private key must be kept secret by its
owner

What Asymmetric Encryption Is

A system that uses two different keys:

• Public key: You can hand it out to the entire planet.

• Private key: You guard it like your last brain cell.

These keys are mathematically connected.

Whatever you encrypt with one can only be decrypted with the other.

How It Works (Actual Logic)

1. Key Pair Generation

A cryptographic algorithm creates:

• A public key

• A private key

They’re linked, but in a way that makes reversing them computationally impossible.

2. Encryption

If someone wants to send you a secret message:

• They encrypt it with your public key

• Only your private key can decrypt it

Even if the public key is copied everywhere (and it usually is), the attacker gains nothing.

PREPARE BY JAY GOSWAMI 9

Chapter-02 Cryptography and Network Analysis

3. Digital Signatures

Flip the usage:

• You sign something using your private key

• Anyone verifies the signature using your public key

That provides authenticity and integrity.

Why Asymmetric Encryption Exists

Because symmetric encryption has a fatal flaw:

You must share the secret key.
Share it incorrectly, and everything burns.

Asymmetric encryption fixes that by making the “key sharing” part public and safe.

Main Algorithms

RSA

• Based on the difficulty of factoring large prime numbers.

• Strong but slower and bulkier.

PREPARE BY JAY GOSWAMI 10

Chapter-02 Cryptography and Network Analysis

• Common in HTTPS, PGP, SSH.

ECC (Elliptic Curve Cryptography)

• Based on algebraic structures of elliptic curves.

• Much smaller keys.

• Faster and more secure at equivalent sizes.

• Used in modern protocols, cryptocurrencies, and mobile devices.

Diffie–Hellman (DH)

• Used mainly for key exchange, not encryption.

• Lets two parties derive a shared secret over an insecure channel.

Advantages

• Secure Key Exchange: It allows parties to securely exchange secret information or

keys over an insecure public channel without meeting beforehand.

• Authentication and Non-Repudiation: Through digital signatures, it provides strong

mechanisms to verify the sender's identity (authentication) and legally bind them to
the message, preventing them from denying the transaction later (non-repudiation).

• Scalability: Each user needs only one public-private key pair to communicate
securely with potentially many other users, simplifying key management in large
networks.

• Confidentiality: It ensures that only the intended recipient, who holds the necessary
private key, can decrypt and read the message.

Disadvantages

• Performance Overhead: The mathematical algorithms involved are significantly more

complex and computationally intensive than those used in symmetric encryption,
making the process much slower.

• Resource Intensity: This slowness makes it impractical for encrypting large volumes
of data directly; it is typically used in a hybrid approach to securely exchange a fast
symmetric key instead.

• Key Length Requirements: To maintain a robust level of security, asymmetric keys

(e.g., RSA keys) must be much longer than symmetric keys (e.g., AES keys), increasing
storage and processing demands.
PREPARE BY JAY GOSWAMI 11
Chapter-02 Cryptography and Network Analysis

Demonstration Steps for AES, DES, and RSA in CyberChef

1. Demonstration of AES Encryption & Decryption

Encryption

1. Open CyberChef.

2. In the left panel, drag the operation “Encrypt / Decrypt → AES Encrypt” into the
recipe area.

3. In the right panel (Input box), type any plaintext message you want to encrypt.

4. In the AES settings:

o Key: Enter a key (UTF-8 e.g., "mysecretkey12345").

o Mode: Choose CBC or GCM.

o IV: Enter a random 16-byte IV UTF (for CBC/GCM) (e.g., randomIV99723311).

o Output format: HEX.

5. The ciphertext will appear in the Output panel automatically.

Decryption

1. Remove the AES Encrypt operation.

2. Drag “AES Decrypt” into the recipe area.

3. Paste the ciphertext into the Input panel.

4. Use the same key, mode, and IV used during encryption.

5. The original plaintext will appear in the Output panel.

PREPARE BY JAY GOSWAMI 12

Chapter-02 Cryptography and Network Analysis

2. Demonstration of DES Encryption & Decryption

Encryption

1. Open CyberChef.

2. Drag “DES Encrypt” into the recipe area.

3. Type any plaintext message into the Input box.

4. Configure the DES settings:

o Key: 8-byte key (UTF-8) (e.g., "12345678").

o Mode: CBC (recommended; ECB exposes patterns).

o IV: 8-byte IV for CBC in UTF-8(e.g., 55555555).

5. The encrypted output will appear on the right.

Decryption

1. Replace the operation with “DES Decrypt”.

2. Paste the DES ciphertext into the Input.

3. Use the same key, mode, and IV.

4. The plaintext will be shown in the Output.

PREPARE BY JAY GOSWAMI 13

Chapter-02 Cryptography and Network Analysis

3. Demonstration of RSA Encryption & Decryption

Step 1: RSA Key Generation in CyberChef

1. Add RSA Key Pair operation

2. Set:

o Key size: 1024

o Output format: PEM

3. CyberChef generates:

o Public key

o Private key

Immediately copy the entire Private Key (including BEGIN PRIVATE KEY and END PRIVATE
KEY) and paste it into the same text file.

Clear the Recipe to start building the encryption/decryption chain.

Step 2: RSA Encryption in CyberChef

Goal

Encrypt plaintext using an RSA public key.

1. Set Input: In the Input field, type the plaintext message you want to encrypt (e.g.,
"Hello RSA Demonstration").

2. Add RSA Encrypt: Drag RSA Encrypt into the Recipe panel.

o In the settings, paste your Public Key into the Key field.

o Set Encryption Scheme to RSAES-OAEP.

o Set Digest Algorithm to SHA-1.

3. Add To Base64: Drag To Base64 into the Recipe panel (below RSA Encrypt).

Observe output

o This is your encrypted data. It should look like random nonsense. If it doesn’t,
something is wrong.

PREPARE BY JAY GOSWAMI 14

Chapter-02 Cryptography and Network Analysis

Step 3: RSA Decryption in CyberChef

Goal

Decrypt the ciphertext using the private key.

Steps

1. Paste ciphertext

o Copy the Base64 output from encryption.

o Paste it into the Input panel.

2. Add From Base64: Drag From Base64 into the Recipe panel (below To Base64).
3. Add RSA Decrypt: Drag RSA Decrypt into the Recipe panel (at the bottom).

o In the settings, paste your Private Key into the Key field.

o Set Encryption Scheme to RSAES-OAEP. (This must match the Encrypt step!)

o Set Digest Algorithm to SHA-1. (This must match the Encrypt step!)

Observe output

o The output should read:

o “Hello RSA Demonstration”

Note This(important)

• RSA does not encrypt large data directly in real systems

• RSA is used to encrypt:

o Symmetric keys

o Hashes (signatures)

• OAEP is not optional if you care about security

• Same padding and hash must be used for encryption and decryption

PREPARE BY JAY GOSWAMI 15

Chapter-02 Cryptography and Network Analysis

Difference Between Symmetric and Asymmetric Encryption

Parameter Symmetric Encryption Asymmetric Encryption

Number of keys Uses one single secret key Uses two keys (public key and
private key)

Key distribution Key must be shared securely Public key can be openly
before communication distributed

Speed Very fast Slow compared to symmetric

encryption

Computational cost Low High

Scalability Poor for large networks Good for large networks

Security risk Key compromise breaks all Private key compromise

communication affects only one entity

Typical use Bulk data encryption Key exchange, authentication

Encryption & Same key Different keys

decryption keys

Example algorithms AES, DES, 3DES, Blowfish RSA, DSA, ECC,

Real-world analogy Same lock and key Public lock, private key

PREPARE BY JAY GOSWAMI 16

Chapter-02 Cryptography and Network Analysis

2. Hashing & Integrity

What Is Hashing
A hash (or hash value) is a fixed-size string of characters, typically a number and/or letters,
that is generated from an input of arbitrary size (like a file, password, or message).

It's produced by a mathematical function called a hash function or hashing algorithm.

Hashing is a one-way mathematical process that converts:

• Any size input

• Into a fixed-size output called a hash value or digest

Example:

"hello" → 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

You cannot reverse that hash to get “hello” back. That’s the entire point.

Key Properties (Why It’s Not Just Fancy Encryption)

A good hash function has these traits:

Deterministic: The same input message will always produce the exact same output hash
value.

Fixed Output Size: Regardless of the input data's size (a single character or a large file), the
output hash will have a predetermined, consistent length.

Efficiency: The hash value should be quick to compute for any given input.

Pre-image Resistance (One-Way): It is computationally infeasible to reverse the process—

meaning you cannot take a hash value and work backward to find the original input data.

Second Pre-image Resistance: Given one specific input and its hash, it is very difficult to find
a different input that produces the same hash value.

Collision Resistance: It should be extremely difficult to find any two different inputs that
produce the same hash output.

Avalanche Effect: A minor change in the input (e.g., changing one letter in a sentence)
should result in a drastically different and seemingly random output hash.

PREPARE BY JAY GOSWAMI 17

Chapter-02 Cryptography and Network Analysis

Core Purpose of Hashing

The purpose of hashing is to verify integrity, prove authenticity, and protect secrets
without ever storing or transmitting the original data.

Hashing does not exist to hide data.

It exists to prove things about data without exposing it.

That distinction is where most people fall apart.

1. Password Protection (Primary Security Purpose)

What problem it solves:

Storing plaintext passwords is catastrophic. One breach and every user is toast across
multiple websites.

What hashing does:

• Converts password → irreversible fingerprint

• Stores only the fingerprint

• During login, hashes again and compares

What this achieves:

• Database leak ≠ password leak

• Admin ≠ password reader

• Insider ≠ account hijacker

What it does NOT solve:

• Weak passwords

• Reused passwords

• Phishing

• Keylogging

Hashing protects systems from database compromise, not from human carelessness.
Different enemies.

PREPARE BY JAY GOSWAMI 18

Chapter-02 Cryptography and Network Analysis

2. Data Integrity Verification (Tamper Detection)

The real purpose here:

To prove that data has not been altered, intentionally or accidentally.

Used for:

• Software downloads

• OS updates

• Digital forensics

• Evidence handling

• Malware detection

What hashing guarantees:

• If the hash matches, the file is bit-for-bit identical

• If one bit changes, the hash breaks completely

This is not “checking if the file looks okay.”

This is mathematical proof of identity.

3. Digital Signatures (Authentication Without Trust)

Hashing enables this chain:

1. Hash the document

2. Encrypt the hash with private key

3. Anyone decrypts it with public key

4. Re-hash the document

5. Compare both hashes

If they match:

• The document is authentic

• It was not modified

• It came from the real signer

Without hashing, digital signatures would be computationally impractical. Hashing makes

them efficient and verifiable.

PREPARE BY JAY GOSWAMI 19

Chapter-02 Cryptography and Network Analysis

4. Blockchain & Distributed Trust (Consensus Without Authority)

Hashing is the backbone of:

• Block linking

• Proof of work

• Transaction immutability

What hashing achieves here:

• Every block depends on the previous hash

• Any modification breaks the entire chain

• Fraud becomes publicly visible

Hashing here replaces:

• Central authority

• Trust in people

• Trust in institutions

With:

• Trust in math

• Verification by everyone

5. Forensics & Legal Evidence Integrity

In investigations, a file without a verified hash is legally weak.

Hashing proves:

• The evidence was not altered

• The chain of custody is intact

• The data is court-admissible

Without hashing, digital evidence is just “trust me bro” in binary form.

PREPARE BY JAY GOSWAMI 20

Chapter-02 Cryptography and Network Analysis

Common algorithms: MD5, SHA family

The MD5 (Message-Digest Algorithm 5) and the SHA (Secure Hash Algorithm) family are the
two most common groups of cryptographic hash functions. They are essential tools for
verifying data integrity and providing digital signatures, but they have distinct security levels
and uses.

MD5: The Legacy Algorithm

MD5 was developed in 1991 and was once the most widely used hash function.

Key Characteristics of MD5

Feature Detail

Output Size
128 bits (typically represented as a 32-character hexadecimal string).
(Digest)

Speed Very fast computation.

Security Status Cryptographically Broken/Insecure.

Primary Use Non-security critical checks, like verifying file integrity against
(Today) unintentional corruption (checksums).

Why MD5 is Insecure

MD5 is considered cryptographically broken because researchers have found ways to

intentionally create collisions. A collision occurs when two different input messages produce
the exact same hash output.

• Collision Vulnerability: It is computationally feasible for an attacker to create two

separate files that result in the same MD5 hash. This completely compromises its use
for digital signatures, as an attacker could replace a legitimate signed file with a
malicious one that has the same accepted hash.

• Speed is a Weakness for Passwords: Although speed is an advantage for file integrity
checks, it's a disadvantage for password hashing. A fast algorithm allows attackers to
perform many more guesses per second in a brute-force or dictionary attack.

PREPARE BY JAY GOSWAMI 21

Chapter-02 Cryptography and Network Analysis

The SHA Family: The Modern Standard

The Secure Hash Algorithm (SHA) family, designed by the NSA and standardized by NIST,
represents the modern standard for cryptographic hashing.

SHA-1

• Output Size: 160 bits.

• Status: Deprecated/Insecure. While more secure than MD5, SHA-1 is also considered
practically broken due to the feasibility of collision attacks. It should no longer be
used for security-critical applications like digital signatures.

SHA-2 Family (SHA-256, SHA-512)

SHA-2 is a family of algorithms that significantly increases the security margin by using
longer hash outputs. This is the current industry standard for most secure applications.

Output Size
Algorithm Typical Representation Key Use Case
(Digest)

256 bits (64- High-security applications

The workhorse; used in Bitcoin
SHA-256 character hex (passwords, certificates,
and most SSL/TLS certificates.
string) blockchain).

512 bits (128- Slower, but offers the highest

Highly sensitive data and
SHA-512 character hex security level against brute-
digital signatures.
string) force attacks.

Advantages of SHA-2 Over MD5

1. Longer Digest: The much larger output size (e.g., 256 bits vs. 128 bits) exponentially
increases the number of possible hashes, making accidental or intentional collisions
virtually impossible with current technology. For a collision in SHA-256, an attacker
would theoretically need 2^128 operations.

2. Higher Security: SHA-2 algorithms have demonstrated excellent collision resistance

and are widely trusted for modern cryptographic tasks.

SHA-3 Family

• Background: SHA-3 was selected in 2012 as a winner of a public competition to

become a standard alternative to SHA-2, in case weaknesses were ever found in SHA-
2.

PREPARE BY JAY GOSWAMI 22

Chapter-02 Cryptography and Network Analysis

• Structure: SHA-3 uses a different internal structure called the Keccak algorithm
(based on a "sponge construction") which is completely different from the Merkle–
Damgård construction used by MD5 and SHA-2.

• Output Size: Supports the same digest lengths as SHA-2 (224, 256, 384, 512 bits).

Summary Comparison

Year Digest Size

Algorithm Security Status Recommended Use
Introduced (Bits)

MD5 1991 128 Broken/Insecure Non-critical checksums only.

SHA-1 1995 160 Vulnerable/Deprecated Avoid for new designs.

Current standard for most

SHA-256 2001 256 Secure
applications.

Maximum security (high

SHA-512 2001 512 Secure
computational cost).

PREPARE BY JAY GOSWAMI 23

Chapter-02 Cryptography and Network Analysis

File integrity verification with hashes

1. What “File Integrity Verification” Actually Means

Definition:
File integrity verification is the process of mathematically proving that a file:

• Has not been modified

• Is bit-for-bit identical to the original

• Was not corrupted in transit

• Was not tampered with by malware or attackers

This is not “checking if the file opens.”

This is cryptographic identity proof.

2. What Hash Integrity Verification Does NOT Do

This is where people confuse themselves into breaches.

• It does NOT prove the file is safe

• It does NOT detect zero-day malware

• It does NOT replace antivirus

• It does NOT guarantee developer credibility

It proves only one thing:

This file is exactly the same as the file that produced this hash.

Nothing more. Nothing less.

3. The Exact Mechanism

Steps to Check File Integrity:

1. Open PowerShell.

2. Calculate the file hash using the following command:

3. Type this command

Get-FileHash <FilePath>

(Replace <FilePath> with the full path of your downloaded file.)

PREPARE BY JAY GOSWAMI 24

Chapter-02 Cryptography and Network Analysis

4. Note the hash value displayed in the output.

5. Compare the calculated hash with the hash provided on the download page.

6. Verify integrity:

o If both hashes match, the file is genuine and unmodified.

o If the hashes do not match, the file may be corrupted or tampered with.

4. Why Hashes Can Prove Integrity

Hashes work because of these two properties:

• Avalanche effect

o 1-bit change → totally different hash

• Collision resistance

o Different malicious file ≠ same hash

So:

• Even a single flipped bit breaks the hash

• Even a fully rebuilt malware version breaks the hash

This makes tampering instantly visible.

PREPARE BY JAY GOSWAMI 25

Chapter-02 Cryptography and Network Analysis

3. Packet Analysis with Wireshark

Introduction to Wireshark & packet capture
1. What Wireshark Actually Is

Wireshark is a protocol analyzer, not a hacking toy, not a magic “see-all” machine.

Definition:
Wireshark is a packet capture and deep packet inspection tool that records, decodes, and
displays network traffic in real time.

What that really means:

• It does not generate traffic

• It does not alter traffic

• It does not break encryption

• It simply observes what your network card is allowed to see

If traffic is encrypted and you don’t have decryption keys, Wireshark will politely show you
encrypted nonsense. As it should.

2. What “Packet Capture” Is:

A packet is:

A structured chunk of data formatted according to a network protocol.

Packet capture means:

Intercepting raw network frames directly from the network interface before applications
process them.

(PCAP), often called "packet sniffing," is the process of intercepting and recording copies of
data packets as they travel across a network. This provides network administrators and
security professionals with a "digital black box" or "CCTV footage" of all network activity,
which can then be analyzed to diagnose problems or investigate security incidents.

How Packet Capture Works

Data transmitted over a network is broken down into small units called packets, each
containing a header (metadata like source/destination IP address, protocol, and port) and a
payload (the actual data being sent).

PREPARE BY JAY GOSWAMI 26

Chapter-02 Cryptography and Network Analysis

Packet capture tools work by:

1. Interception: The capture system is strategically placed at a point in the network

(e.g., using a test access point (TAP) or a SPAN/mirror port on a switch) where it can
access the traffic.

2. Copying: The system creates exact duplicates of each packet without interfering with
the original data flow.

3. Timestamping: Each copied packet is marked with a precise timestamp, which is

crucial for reconstructing the sequence of events during analysis.

4. Storage: The captured packets, including both the header and payload, are written to
a file in a standard format, most commonly the .pcap or .pcapng format.

Purpose in Network Analysis

Packet capture provides granular, indisputable evidence of network activity, which is

invaluable for several purposes:

• Network Troubleshooting: Analysts can review captured packets to pinpoint the root
cause of performance issues, such as high latency, packet loss, or network
congestion, and determine if the problem is application- or network-related.

• Security Incident Response: In the event of a breach, PCAP data serves as crucial
forensic evidence to determine how an attacker gained access, what systems were
compromised, and what data was exfiltrated.

• Threat Detection and Hunting: By analyzing raw packet data, security teams can
detect anomalous behavior, malware communication, or zero-day exploits that might
bypass traditional security tools (like firewalls or intrusion detection systems).

• Compliance and Auditing: Captured packet data provides a reliable, detailed audit
trail of network activity, helping organizations meet regulatory requirements (like
GDPR or HIPAA) for monitoring and data protection.

Common Tools

Captured files are typically analyzed offline using specialized software tools, which present
the raw data in a human-readable format. Popular examples include:

• Wireshark: A widely used, free, and open-source graphical network protocol

analyzer.

PREPARE BY JAY GOSWAMI 27

Chapter-02 Cryptography and Network Analysis

• tcpdump: A powerful command-line interface tool favored for quick or automated

captures, especially in Unix-like environments.

• Pktmon: A built-in, cross-component network diagnostics tool for Windows.

3. Where Wireshark Sits in the Network Stack

OSI Layer What Wireshark Sees

Layer 1 - Physical No

Layer 2 - Data Link Yes

Layer 3 - Network Yes

Layer 4 - Transport Yes

Layer 5–7 - Application If not encrypted

If encryption starts at Layer 5 or above (TLS), Wireshark still captures the packet but cannot
read the content.

That’s not a limitation. That’s how security works.

4. Core Purpose of Wireshark

Wireshark exists for four serious reasons:

• Network troubleshooting

• Protocol analysis

• Security investigation

• Digital forensics

It does not exist:

• To “hack WiFi”

• To spy on random people

• To bypass encryption

• To look impressive in screenshots

PREPARE BY JAY GOSWAMI 28

Chapter-02 Cryptography and Network Analysis

5. What a Packet Actually Contains

Every captured packet is structured like this:

1. Frame Header

o MAC addresses

2. Network Header

o IP addresses

3. Transport Header

o Ports, sequence numbers

4. Application Data

o HTTP, DNS, FTP, etc.

5. Frame Trailer

o Error detection

Wireshark decodes and displays each layer separately so you can see exactly what the
system is doing.

PREPARE BY JAY GOSWAMI 29

Chapter-02 Cryptography and Network Analysis

Monitoring traffic and analyzing protocols (TCP, HTTP, ICMP)

How to Monitor with Wireshark

The process of using Wireshark involves four main steps:

1. Capture Setup: Select the correct network interface (e.g., Wi-Fi adapter or Ethernet
port) on which the traffic you want to monitor is flowing.

2. Capturing: Start the capture. Wireshark collects all packets seen by that interface.

3. Filtering: Apply capture filters (to reduce the amount of data captured) or display
filters (to quickly locate relevant packets in the captured file).

4. Analysis: Examine the decoded packet details to understand the protocol behavior
and identify anomalies.

Protocol-Specific Analysis in Wireshark

To effectively analyze TCP, HTTP, and ICMP, you use specific display filters in the Wireshark
filter bar (e.g., tcp, http, or icmp) to isolate the relevant conversations.

1. TCP Analysis (Reliability & Performance)

TCP is the backbone of reliable connections. Analyzing it helps diagnose connectivity and
throughput issues.

TCP, or Transmission Control Protocol, is a core internet protocol that ensures reliable,
ordered, and error-checked delivery of data between devices on a network. It establishes a
connection-oriented, "three-way handshake" to confirm a connection before data
transmission, breaks data into packets, numbers them, and reassembles them in the correct
order at the destination. TCP handles lost or damaged packets by requesting retransmission,
making it crucial for applications like web browsing and email where data accuracy is critical

• Display Filter: tcp

• Key Conversations to Examine:

o The Three-Way Handshake: Filter for [Link] == 1 and [Link] == 1

to see the connection establishment packets (SYN $\to$ SYN-ACK $\to$ ACK).
Troubleshooting: If you see only a SYN without a response, a firewall or
server issue is blocking the connection.

PREPARE BY JAY GOSWAMI 30

Chapter-02 Cryptography and Network Analysis

o Retransmissions: Use the filter [Link]. High numbers of

retransmissions indicate packet loss or network congestion, which severely
degrades performance.

o Window Size: Inspect the TCP header's Window Size field. This indicates how
much data the receiver is willing to accept. A small window can cause a
throughput bottleneck ("Window Full" or "Zero Window" packets).

o Connection Reset (RST): The filter [Link] == 1 highlights forced

connection termination, usually indicating an application error or abrupt
closure.

2. HTTP Analysis (Web Application Performance)

HTTP runs over TCP and defines how web clients (browsers) request and servers deliver
content.

HTTP, or Hypertext Transfer Protocol, is the foundation of data communication for the World
Wide Web, allowing browsers and servers to exchange information. It works on a client-
server model where a client (like a web browser) sends a request to a server, which then
responds with the requested data, such as an HTML page, image, or video. This request-
response system is a set of rules that ensures data is transferred correctly and reliably across
the internet, often using TCP/IP as the underlying transport protocol.

• Display Filter: http

• Key Data to Examine:

o Request/Response Timing: Right-click an HTTP packet and select Follow ->

TCP Stream to view the entire conversation. Look at the time delta between
the GET/POST request and the server's HTTP response to determine server
latency.

o Status Codes: Filter for specific HTTP status codes to find errors:

▪ [Link] == 404: Client requested a resource that was Not

Found.

▪ [Link] == 500: Internal Server Error (a problem on the

server side).

o Unencrypted Credentials: If the protocol is plain HTTP (port 80), you can see
usernames and passwords (if sent in the payload) in clear text within the
packet details.

PREPARE BY JAY GOSWAMI 31

Chapter-02 Cryptography and Network Analysis

3. ICMP Analysis (Diagnostics and Connectivity)

ICMP is primarily used for reporting network errors and performing diagnostics (like the ping
and traceroute commands).

The Internet Control Message Protocol (ICMP) is a core network layer protocol in the TCP/IP
suite, used by devices like routers and hosts to send error messages and operational info,
signaling network problems like unreachable destinations or packet life expiration, with the
famous ping command (Echo Request/Reply) being its most common use for testing
connectivity. It's not for data delivery but for diagnostics, working alongside IP to report
failures, not correct them, and is enhanced in IPv6 as ICMPv6 for more advanced functions
like Neighbor Discovery

• Display Filter: icmp

• Key ICMP Messages:

o Echo Request/Reply: This is the standard ping traffic. The time difference
between the request and reply provides the Round Trip Time (RTT),
measuring basic network latency.

o Destination Unreachable: This message indicates a host or network cannot

be reached. It often pinpoints a routing or firewall misconfiguration.
Troubleshooting: Examine the "Code" field within the ICMP header to see the
specific reason (e.g., Host Unreachable, Port Unreachable).

o Time-to-Live (TTL) Exceeded: This is used by the traceroute utility to map the
path to a destination. Seeing these messages indicates the packet has passed
through a router (hop).

Stream Analysis Feature

A powerful feature in Wireshark for protocols like TCP and HTTP is Follow Stream.

1. Right-click on any packet belonging to the conversation.

2. Select Follow $\to$ TCP Stream (or HTTP Stream).

This reassembles the sequence of packets into a single, cohesive view, showing the full
payload data sent between the client and server, which is essential for understanding the
application-level data transfer.

PREPARE BY JAY GOSWAMI 32