Cyber Security Lab Notes: Packet Analysis & Wireshark
Topic: Network Forensics & Protocol Analysis Tools: Wireshark, Ettercap, Browser
(Firefox/Chrome)
1. Basic Packet Inspection
Goal: Understand data transmission via fundamental protocols.
• Setup: Open Wireshark -> Select Network Interface (eth0/wlan0) -> Start "Blue Shark"
icon.
• Filtering: Use the display bar to isolate noise. Common filters: [Link] == [target IP], dns,
http.
A. HTTP (Hypertext Transfer Protocol)
• Observation: HTTP is clear text.
• Key Packets:
o GET /[Link] HTTP/1.1 (Client asking for a page).
o HTTP/1.1 200 OK (Server responding).
• Technique: Right-click packet -> Follow -> TCP Stream. This reconstructs the full
webpage/html content from the packets.
B. DNS (Domain Name System)
• Observation: Translates Domain Names ([Link]) to IP addresses (142.250.x.x).
• Structure:
o Query: "Where is [Link]?"
o Response: "It is at [Link]"
• Note: DNS runs on UDP (usually) or Port 53.
C. SMTP (Simple Mail Transfer Protocol)
• Observation: Used for sending email.
• Port: 25, 587, or 465.
• Analysis: Look for the "Envelope" in the payload:
o MAIL FROM: <sender@[Link]>
o RCPT TO: <receiver@[Link]>
o DATA (The body of the email).
2. Detecting Suspicious Activity
Goal: Identify anomalies indicating potential attacks.
• Scan Detection (Port Scanning):
o Pattern: A single host sending SYN packets to multiple ports on a target server.
o Filter: [Link]==1 && [Link]==0
o Interpretation: If you see many SYN packets from one IP without many ACK
replies, it’s likely a scan.
• Ping Sweeps:
o Pattern: ICMP Echo Requests sent to multiple IPs in a subnet.
o Filter: [Link] == 8
• Data Exfiltration:
o Pattern: Large amounts of data leaving the internal network to an external
unknown IP during off-hours.
o IOE (Indicator of Exploitation): Unusual protocol usage (e.g., DNS tunneling
where data is hidden inside DNS queries).
3. Malware Traffic Analysis
Goal: Spot "Beaconing" and Command & Control (C2).
• C2 Communication:
o Malware infected machine contacts a "Master" server for instructions.
o Signs: Persistent connections to a specific IP on a non-standard high port (e.g.,
4444, 8080).
• Heartbeats (Beaconing):
o Pattern: Look at the "Time" column in Wireshark.
o Observation: If packets are sent exactly every 60 seconds (or 30, or 10) like a
clock, it is automated malware checking in.
o Filter: frame.time_delta (Useful for statistics).
• Traffic Volume:
o Infiltration: Small packets in (instructions).
o Exfiltration: Large packets out (stolen data).
4. Password Sniffing
Goal: Demonstrate the danger of unencrypted credentials.
• Scenario: Logging into a legacy HTTP site (e.g., [Link]
• Capture:
1. Start Wireshark.
2. Login to the site with admin / password.
3. Stop capture.
• Analysis:
o Filter: [Link] == "POST"
o Inspect the packet -> Right Click -> Follow -> TCP Stream.
o Result: You will clearly see: username=admin&password=password.
• Conclusion: Without SSL/TLS (HTTPS), anyone on the LAN can steal credentials.
5. ARP Poisoning Attack (MitM)
Goal: Intercept traffic between Victim and Gateway.
• Concept:
o Normal: IP -> MAC mapping is trusted.
o Attack: Attacker tells Victim "I am the Gateway" and tells Gateway "I am the
Victim".
o Tool: Ettercap (Graphical mode or Text mode).
o Command: ettercap -T -M arp:remote /<Victim IP>// /<Gateway IP>//
• Wireshark Analysis of Attack:
o Filter: arp
o What to see: Duplicate ARP replies. You will see the Attacker's MAC address
associated with both the Victim's IP and the Gateway's IP.
o Result: The Victim sends packets to the Attacker instead of the Gateway. The
Attacker forwards them to the Gateway (MitM).
Questions & Answers (Q&A)
Basic Concepts & Wireshark Interface
1. Q: What is Wireshark? A: Wireshark is a free, open-source network protocol analyzer
used to capture and inspect network traffic in real-time.
2. Q: What does "Promiscuous Mode" do? A: It allows the network interface card (NIC) to
capture all traffic passing on the network, not just traffic destined for the machine's MAC
address.
3. Q: What is the difference between a Capture Filter and a Display Filter? A: A Capture
Filter limits what packets are saved to the disk (e.g., port 80). A Display Filter hides
packets already captured but not matching the criteria (e.g., [Link] == [Link]).
4. Q: How do you stop a packet capture in Wireshark? A: Click the red square "Stop" button
in the top toolbar or press Ctrl+E.
5. Q: What is the "Three-Way Handshake" in TCP? A: It is the process to establish a
connection: SYN (Synchronize), SYN-ACK (Synchronize-Acknowledge), ACK
(Acknowledge).
6. Q: Which column in Wireshark helps you identify the time between packets? A: The
"Time" column (specifically "Time since previous captured packet").
7. Q: What does a "Packet" represent? A: A unit of data encapsulated at the Network Layer
(Layer 3) containing headers and payload.
8. Q: What is a "Frame"? A: A unit of data at the Data Link Layer (Layer 2), essentially the
packet plus the Ethernet header and trailer.
9. Q: How can you export specific packets from a large capture? A: Select the packets ->
File -> Export Specified Packets.
10. Q: What color does Wireshark use for TCP errors? A: Usually Black or Red (depending on
version), often marked as "[TCP Retransmission]" or "[TCP Previous segment not
captured]".
Protocol Analysis (HTTP, DNS, SMTP)
11. Q: On which port does standard HTTP traffic operate? A: Port 80.
12. Q: On which port does HTTPS traffic operate? A: Port 443.
13. Q: Why can't we read the content of HTTPS packets in Wireshark? A: Because the
payload is encrypted using SSL/TLS. Wireshark only sees the handshake and encrypted
gibberish.
14. Q: What is the primary function of DNS? A: To resolve human-readable domain names
(like [Link]) into machine-readable IP addresses.
15. Q: Which transport protocol does DNS typically use? A: UDP (User Datagram Protocol),
though it uses TCP for large responses (Zone Transfers).
16. Q: How do you filter for only DNS traffic in Wireshark? A: Type dns in the display filter
bar.
17. Q: What does a "Query" in DNS signify? A: The client asking for the IP address of a
domain.
18. Q: What is SMTP used for? A: Sending emails from a client to a server or between
servers.
19. Q: What is the standard port for SMTP? A: Port 25.
20. Q: How can you view the full email body in Wireshark? A: Right-click a SMTP packet ->
Follow -> TCP Stream.
21. Q: What is the difference between GET and POST in HTTP? A: GET requests data from
the server (parameters in URL); POST submits data to be processed (parameters in the
body, used for logins/forms).
22. Q: What HTTP status code represents "Not Found"? A: 404.
23. Q: What HTTP status code represents "OK"? A: 200.
24. Q: What is a User-Agent string in HTTP? A: It identifies the browser and operating system
of the client to the server.
25. Q: What does the "Referer" header in HTTP show? A: The URL of the previous webpage
the user was on, which linked to the current request.
Suspicious Activity & Anomaly Detection
26. Q: What is a "Port Scan"? A: An attempt by an attacker to identify open ports and
services on a target machine.
27. Q: What is a SYN Flood attack? A: An attacker sends a massive number of SYN packets
but never completes the handshake, exhausting the target's resources.
28. Q: Which Wireshark filter shows only TCP SYN packets? A: [Link]==1 &&
[Link]==0
29. Q: What is "ICMP Tunneling"? A: Hiding data inside ICMP Echo Request (ping) packets to
bypass firewalls.
30. Q: Why is communication on non-standard ports suspicious? A: Malware often uses
high, random ports (like 4444, 12345) to evade firewalls that block standard ports.
31. Q: What is a "Ping Sweep"? A: Sending ICMP pings to a range of IP addresses to see
which hosts are alive.
32. Q: What does "TTL Exceeded" mean? A: The packet has passed through too many
routers (hops) and was discarded. Common in traceroute or network loops.
33. Q: How do you identify a "Christmas Tree Packet"? A: A packet with all TCP flags turned
on (FIN, URG, PSH, etc.). Used for reconnaissance or OS fingerprinting.
34. Q: What is a "Zero-Day" exploit in terms of traffic? A: Exploiting a vulnerability unknown
to the vendor; traffic signatures might not exist yet, making detection hard.
35. Q: What is "Data Exfiltration"? A: The unauthorized transfer of data from a computer
(insider threat or malware).
Malware Traffic Analysis
36. Q: What is "Beaconing" in malware traffic? A: Regular, periodic outbound connections
from an infected host to a C2 server to await instructions.
37. Q: Why is "Fast Flux" used by malware? A: It rapidly changes the IP addresses associated
with a domain name to avoid detection and blacklisting.
38. Q: What is a "Command and Control" (C2) server? A: A server controlled by the attacker
that issues commands to infected malware bots.
39. Q: How can you distinguish malware beaconing from normal user browsing? A:
Beaconing is highly rhythmic (e.g., exactly every 60 seconds), whereas human browsing
is erratic.
40. Q: What is "Domain Generation Algorithm" (DGA)? A: Malware generating random
domain names daily to prevent security analysts from blocking the C2 domain.
41. Q: What does "Tunnelling" mean in malware analysis? A: Encapsulating malicious traffic
inside a allowed protocol (like HTTP or DNS) to bypass firewalls.
42. Q: What is a "Botnet"? A: A network of infected computers ("bots") controlled by a
central C2 server, often used for DDoS attacks.
43. Q: Why does malware often use encrypted channels (HTTPS)? A: To hide the payload
content from intrusion detection systems (IDS) and packet sniffers like Wireshark.
44. Q: What is a "Dropper" in malware? A: A program designed to "drop" (install) the actual
malicious payload onto the victim's machine.
45. Q: What is the significance of a high "Time to Live" (TTL) value in suspicious packets? A:
It can indicate the packet originated locally or is being spoofed to look local (TTL
analysis).
Password Sniffing & Attacks
46. Q: Why are passwords sent via HTTP vulnerable? A: HTTP is plain text; anyone
intercepting the traffic can read the password directly.
47. Q: What is the Wireshark filter to find login attempts? A: [Link] ==
"POST"
48. Q: How does encryption (HTTPS/SSL) protect passwords? A: It scrambles the data
(payload) so that even if intercepted, it appears as random characters without the
decryption key.
49. Q: What is a "Man-in-the-Middle" (MitM) attack? A: An attack where the attacker
secretly intercepts and relays messages between two parties who believe they are
communicating directly.
50. Q: What protocol does an ARP Poisoning attack exploit? A: The Address Resolution
Protocol (ARP), which maps IP addresses to MAC addresses.
ARP Poisoning Specifics
51. Q: What is the purpose of ARP? A: To find the MAC address (hardware address)
associated with a given IP address on a local network.
52. Q: How does an ARP Poisoning attack work? A: The attacker sends fake ARP messages
(gratuitous ARP) linking the attacker's MAC to the gateway's IP, tricking victims into
sending traffic to the attacker.
53. Q: What is "Gratuitous ARP"? A: An ARP packet sent by a host to announce its IP address
to the network without being asked.
54. Q: What is "ARP Spoofing"? A: Another name for ARP Poisoning; forging ARP messages
to link an attacker's MAC to a legitimate IP.
55. Q: How can you detect ARP Poisoning in Wireshark? A: Look for duplicate ARP replies or
two different IP addresses claiming the same MAC address.
56. Q: What is the default gateway in a home network? A: The router's IP address (e.g.,
[Link]) that connects the local network to the internet.
57. Q: Why is ARP stateless? A: Because devices accept ARP replies even if they didn't send a
request, making them vulnerable to spoofing.
58. Q: What happens to traffic during a successful ARP Poisoning attack? A: Traffic intended
for the gateway flows through the attacker's machine before reaching the gateway.
59. Q: What tool is commonly used for ARP spoofing in Kali Linux? A: Ettercap, Bettercap, or
arpspoof.
60. Q: How can you defend against ARP Poisoning? A: Use static ARP entries, Dynamic ARP
Inspection (DAI) on switches, or VPN encryption.