Laboratory Manual

Of
NETWORK MANAGEMENT SYSTEMS
AND OPERATIONS LAB

[Link]. IV Year I Sem (R22 CSC)

DEPARTMENT OF CSC

KESHAV MEMORIAL COLLEGE OF

ENGINEERING
Chinthapallyguda(V), Ibrahimpatnam(M) Ranga Reddy
Dist.

NETWORK MANAGEMENT SYSTEMS AND OPERATIONS LAB

[Link]. IV Year I Sem. L T P C

0 0 2 1
Course Objectives:
 Comprehensive understanding of network management.
 Learn about network configurations, security policies, and risk assessments.
 Learn about diagnosing and troubleshooting network faults, performance assessment, and
optimization.

Course Outcomes:
 Understanding the challenges and structure of network management in the context of the Internet.
 Defining network management and comprehending its scope, challenges, and variety in multi- vendor
environments.
 Identifying and diagnosing network faults, understanding trouble reports, and learning
troubleshooting techniques.
 Exploring the various network management tools.

List of Experiments:
1. Network Discovery and Mapping
A. Utilize tools like Nmap and Wireshark to perform network discovery.
B. Create a visual map of the network infrastructure.
C. Analyze the implications of the network structure on management strategies.

2. Policy Implementation and Compliance

A. Use tools like Snort or Suricata for intrusion detection.
B. Implement firewall rules with tools such as iptables or pfSense.
C. Assess compliance with security policies and regulatory requirements.

3. Automation with Ansible

A. Set up Ansible for network configuration management.
B. Automate routine tasks such as software updates and configuration changes.
C. Evaluate the impact of automation on efficiency and responsiveness.
4. Fault Detection with Wireshark and Nagios
5. Protocol Analysis with Tcpdump
6. Traffic Analysis with Wireshark and Bandwidthd
7. Traffic Measurement with Ntopng
8. Threat Modeling with OWASP Cornucopia
9. Risk Assessment with OpenVAS
10. Firewall Configuration with pfSense
11. Network Discovery with Nmap
12. Security Enforcement with Snort

TEXT BOOK:
1. Automated Network Management Systems, D. Comer, Prentice Hall, 2006, ISBN No.
0132393085.
REFERENCE BOOKS:
1. Nagios Core Administration Cookbook - Second Edition, Tom Ryder, 2016, Packt Publishing, ISBN:
781785889332.
2. Terraform: Up and Running, Yevgeniy Brikman, 2017, O'Reilly Media, Inc., ISBN:
9781491977088
 Week 1:
1. Network Discovery and Mapping

a. Utilize tools like Nmap and Wireshark to perform network discovery.

b. Create a visual map of the network infrastructure.
c. Analyze the implications of the network structure on management strategies.

Network Discovery and Mapping is the process of identifying and documenting all the devices and
connections on a computer network. It provides visibility into the network's structure, devices, IP
addresses, and communication paths, which is essential for effective network management, security,
and troubleshooting.

Nmap — host & service discovery (overview

+ safe examples)
Purpose: quickly discover which devices exist and what services/ports they expose.
Key modes and examples (assume you have permission):
 Ping sweep (find live hosts)
nmap -sn [Link]/24
→ tells which IPs respond (ICMP/ARP/host discovery).
 Quick top ports (fast service visibility)
nmap -sT --top-ports 100 [Link]/24
→ TCP connect scan of the 100 most common ports.
 Service/version detection (identify service and version)
nmap -sV [Link]
→ probes discovered ports to report service names and versions.
 OS detection (use cautiously, may be noisy)
nmap -O [Link]
→ attempts to fingerprint OS — can trigger IDS/IPS.
 Stealth/non-intrusive scan for sensitive environments
nmap -sS -T2 [Link]/24
→ SYN scan with slower timing to reduce noise (still requires permission).
Tips:
 Start broad (live hosts), then target specific hosts for deeper scans.
 Use -oA basename to save results in three formats (nmap, grepable, xml).
 Watch timing (-T): -T4 is faster but noisier; -T1/-T2 are stealthier.
 Be cautious with aggressive NSE scripts or brute force scans — they can disrupt
services.

Wireshark — capture & analyze traffic

Purpose: inspect packets to verify behavior, troubleshoot protocols, confirm what services
actually communicate.
Capture advice:
 Capture on the network segment where the traffic flows (mirrored SPAN port, on-host
capture, or gateway).

4
  Use capture filters (pcap-level BPF) to limit volume: e.g., host [Link] and
port 80
(set in the capture options box or as tcpdump/tshark capture filter).
 Save captures to .pcapng for later analysis.
Display filters (for interactive analysis):
 Show only traffic to/from an IP: [Link] == [Link]
 Show only HTTP traffic: http
 Show TCP handshakes/flows: tcp && [Link] == [Link]
 Show DNS queries: dns or [Link] == 53
 Show TLS/SSL: tls (or ssl in older versions)
Useful Wireshark features:
 Follow TCP Stream — right-click a TCP packet → Follow → TCP Stream
(reconstructs conversation).
 Statistics → Endpoints / Protocol Hierarchy / Conversations — get overview
counts and dominant protocols.
 IO Graphs — visualize traffic volume over time.
 Expert Info — highlights suspicious/retransmissions/errors.
 Name resolution — can resolve IPs to names (useful but can add noise).
Command-line equivalent: tshark for automated captures/filters:
 Example: tshark -i eth0 -f "host [Link] and port 443" -w
[Link]

Combine Nmap + Wireshark effectively

1. Discover hosts with Nmap (-sn) to limit capture scope.
2. Target a specific host/service with Nmap -sV to see which ports to watch.
3. Start a capture on the relevant interface using a capture filter for that host/port.
4. Reproduce the activity you want to observe (e.g., connect a client to the service).
5. Analyze capture in Wireshark (follow stream, check protocol exchanges, look for
retransmits/resets).
Example scenario: troubleshooting an HTTP service that Nmap shows open but clients fail to
connect:
 Run nmap -sV [Link] -p 80,443 to confirm service.
 Capture: tshark -i eth0 -f "host [Link] and (port 80 or port
443)" -w [Link]
 Attempt client connection, then analyze with [Link] == [Link] && http
in Wireshark.

WeeK 2:

[Link] Implementation and Compliance

A. Use tools like Snort or Suricata for intrusion detection.

B. Implement firewall rules with tools such as iptables or pfSense.
C. Assess compliance with security policies and regulatory requirements.
Feature Snort Suricata
Cisco (original creator: OISF (Open Information Security
Developer
Sourcefire) Foundation)

5
 Feature Snort Suricata
Single-threaded (Snort 2),
Speed/Performance Multi-threaded, high performance
moderate
Signature-based + protocol-aware +
Detection Capabilities Signature-based
anomaly-based
Protocol Parsing Good Very good (more DPI features)
Multithreading ❌ (Snort 2) / ✅ (Snort 3) ✅ Fully multithreaded
Lower (Snort 2); better in
Throughput Higher; handles multi-gigabit traffic
Snort 3
Rule Compatibility Uses Snort rule format Compatible with Snort rules
Unified2, plain text, JSON
Output/Logging Native JSON, EVE log format
(with addons)
Excellent (can detect protocols on
Protocol Detection Good
non-standard ports)
Slightly more complex, but modern
Ease of Setup Mature, stable, good docs
tools
Community & Large community; Cisco- Growing community, strong OISF
Support backed support
Simpler, traditional IDS/IPS High-performance environments,
Best Use Case
deployments modern setups

Use Snort if you:

 Are deploying in a low- to mid-throughput environment.
 Need simpler setup or compatibility with older infrastructures.
 Want a mature and well-documented IDS with lots of tutorials.
 Are okay with running Snort 2 (single-threaded) or are ready to try Snort 3, which
adds multithreading.

Example Snort use cases:

 IDS on small office/home office (SOHO) networks.

 Lab/testing environments to learn IDS rules.
 Complement to a pfSense firewall (which includes Snort packages).

Use Suricata if you:

 Need high-performance, multithreaded IDS/IPS.
 Are monitoring 1 Gbps+ traffic, or multiple interfaces.
 Want modern logging (JSON, EVE) for SIEM integration (e.g., with ELK, Splunk).
 Want advanced protocol detection, like identifying HTTP over port 8080 or TLS
over non-standard ports.
 Prefer a more modern architecture and plan to scale.

Example Suricata use cases:

 Enterprise-scale IDS on multi-gigabit networks.

 Integration with Security Onion, Wazuh, or SIEM pipelines.

6
  Environments using Zeek + Suricata for layered visibility (Suricata for alerts, Zeek
for full traffic context).

Deployment Tools & Ecosystems

 Security Onion includes both Snort and Suricata (Suricata is default).
 pfSense uses Snort as its main IDS plugin (but can support Suricata).
 Wazuh + Suricata is a strong open-source SIEM + IDS combo.

Real-world example setup (Suricata)

sudo apt install suricata
sudo suricata-update # to pull in community rules
sudo suricata -c /etc/suricata/[Link] -i eth0
tail -f /var/log/suricata/[Link]
tail -f /var/log/suricata/[Link] | jq .
tail -f /var/log/suricata/[Link]
tail -f /var/log/suricata/[Link] | jq .

Environment size Recommended IDS

Home/lab/small Snort (or Snort 3)
Medium/enterprise Suricata
High-performance / scalable / JSON logs needed Suricata
Just learning IDS rules Start with Snort 2, then upgrade or switch

Week 3:
[Link] with Ansible
A. Set up Ansible for network configuration management.
B. Automate routine tasks such as software updates and configuration
changes.
C. Evaluate the impact of automation on efficiency and responsiveness.

What is Ansible?
Ansible is an open-source automation tool by Red Hat that allows you to define infrastructure
as code using simple, human-readable YAML files (called playbooks). It operates
agentlessly over SSH (or WinRM for Windows), making it easy to get started.

Key Features of Ansible

 Agentless: No software is required on managed nodes
 YAML-based Playbooks: Easy-to-read automation scripts
 Idempotent: Running the same playbook multiple times results in the same system
state
 Extensible: Modules for virtually everything (e.g., system, cloud, network)
 Cross-platform: Linux, Windows, cloud (AWS, Azure, GCP), networking
equipment

Component Description
Inventory List of target systems (static file or dynamic)
Playbook YAML script defining automation tasks
Task A single action to perform

7
Component Description
Module Reusable code unit (e.g., yum, copy, service)
Role Predefined set of tasks, templates, and handlers
Handler Task triggered by a change (e.g., restart service)
Facts System information gathered by Ansible
Templates Jinja2-based config files with variables

Example Use Cases

 System configuration (e.g., install packages, set up services)
 Cloud provisioning (e.g., create EC2 instances on AWS)
 Application deployment (e.g., deploy web apps with dependencies)
 Security hardening
 CI/CD automation

---
- name: Install and start Apache
hosts: webservers
become: yes

tasks:
- name: Install Apache
apt:
name: apache2
state: present
update_cache: yes

- name: Ensure Apache is running

service:
name: apache2
state: started
enabled: yes
Create an inventory file:

[webservers]
[Link]
Run the playbook:
ansible-playbook -i inventory [Link]

Week 4:
Fault Detection with Wireshark and Nagios

Fault Detection with Wireshark and Nagios involves using both tools to identify,
analyze, and respond to network or system faults. These tools serve different but
complementary purposes in a monitoring and diagnostics setup.
Tool Purpose Use Case
Network protocol analyzer (packet
Wireshark In-depth network traffic analysis
sniffer)
Nagios Infrastructure monitoring tool Fault detection, alerting, and reporting

Fault Detection with Wireshark

Wireshark captures and analyzes network packets to help identify problems such as:

8
✅ What It Can Detect:

 Packet loss
 Network latency
 TCP retransmissions
 DNS failures
 Unauthorized traffic
 ARP spoofing
 Congested links
 Misconfigured network services

Example Use Cases:

 Diagnosing slow application performance by analyzing TCP handshake and

response times
 Detecting DoS attacks by capturing large volumes of suspicious traffic
 Identifying unauthorized devices sending/receiving unexpected packets

How to Use Wireshark for Fault Detection:

1. Start a capture on a target interface

2. Use display filters to narrow down:
o [Link]
o icmp
o dns
o [Link]
3. Look at I/O graphs, packet lengths, and conversations
4. Analyze anomalies (e.g., high retransmission rate, failed handshakes)

Fault Detection with Nagios

Nagios is ideal for proactive fault detection, offering automated checks and alerting.

✅ What It Can Detect:

 Service or host downtime

 High CPU/memory usage
 Disk failures or low space
 Network latency or outages
 Failed logins or security breaches
 Application-level issues (web, DB, etc.)

Example Use Cases:

 Monitor if a web server goes down

 Check if disk usage exceeds 90%
 Alert if a switch is unreachable
 Detect high network latency

9
How Nagios Works:

1. Install Nagios Core or Nagios XI

2. Define hosts/services to monitor in config files
3. Use plugins to check health:
o check_ping
o check_http
o check_disk
o check_load
4.  Set up email/SMS alerts on failure
5.  Use dashboards to track incidents and trends

Scenario Wireshark Role Nagios Role

Web server is slow Inspect traffic to/from server Alert when service is slow/down
High packet loss Analyze dropped packets Detect latency via ping checks
Unauthorized traffic Capture suspicious packets Monitor port changes or login failures
Intermittent outages Analyze timestamps of failures Alert when system becomes unreachable

Workflow Example:

1. Nagios detects that Server A is unreachable → Sends alert

2. Admin checks Wireshark capture during outage window
3. Finds ARP poisoning or ICMP flood
4. Resolves issue (e.g., blocks rogue device, fixes firewall rule)

Week 5:
Protocol Analysis with Tcpdump

Protocol analysis with tcpdump involves capturing and examining network traffic to
understand which protocols are being used, how devices are communicating, and whether
there are any anomalies, inefficiencies, or security issues.
Here's a comprehensive guide to using tcpdump for protocol analysis:

What is tcpdump?

tcpdump is a command-line packet analyzer tool used to capture and inspect network traffic
in real time. It allows filtering based on protocols, IPs, ports, and more.

sudo tcpdump [options] [filter]

sudo tcpdump -i eth0

sudo tcpdump -i eth0

sudo tcpdump -i eth0

Protocol Command Example

HTTP sudo tcpdump -i eth0 tcp port 80
HTTPS sudo tcpdump -i eth0 tcp port 443
DNS sudo tcpdump -i eth0 udp port 53

10
 Protocol Command Example
ICMP (Ping) sudo tcpdump -i eth0 icmp
DHCP sudo tcpdump -i eth0 port 67 or port 68
SMTP sudo tcpdump -i eth0 port 25
FTP sudo tcpdump -i eth0 port 21
sudo tcpdump -i eth0 -w [Link]

Task Command
Capture only TCP packets tcpdump tcp
Capture traffic from a specific IP tcpdump host [Link]
Capture traffic to a specific port tcpdump port 22
Capture traffic between two IPs tcpdump host [Link] and [Link]
Exclude a protocol tcpdump not arp
15:10:32.189456 IP [Link].50672 > [Link].80: Flags [S], seq 0, win
29200, length 0
Look for:

 TCP Handshakes: SYN → SYN-ACK → ACK

 Retransmissions: repeated sequence numbers
 Unusual ports or unexpected protocols
 Broadcast/multicast traffic (could be chatty protocols like mDNS or NetBIOS)

tcpdump 'tcp[tcpflags] & (tcp-syn) != 0 and dst port 80'

tcpdump -i eth0 udp port 53 and 'udp[10:2] > 50'

tcpdump -A -i eth0 tcp port 80

tcpdump –n

tcpdump -c 100
Week 6 :
Traffic Analysis with Wireshark and Bandwidthd

Wireshark

 A GUI-based network protocol analyzer

 Captures and inspects packets in real-time
 Shows protocol details, errors, retransmissions, handshakes, etc.

🔹 Bandwidthd

 A web-based bandwidth usage tracker

 Tracks bandwidth by IP address and protocol
 Generates graphs and reports over time
 Good for long-term monitoring, unlike Wireshark

11
Traffic Analysis with Wireshark
🟢 Capture Traffic

1. Open Wireshark.
2. Select the correct interface (e.g., eth0, wlan0).
3. Click Start Capturing.

Feature Wireshark Bandwidthd

Packet-level (deep Traffic-level (usage
Level
inspection) trends)
UI GUI Web-based reports
Yes (but more
Real-time Yes
historical)
Yes (flags, payloads, No (only traffic
Protocol details
headers) volumes)
Troubleshooting & Monitoring &
Best for
forensic analysis usage tracking
Task Tool
Deep packet inspection Wireshark
Bandwidth monitoring
Bandwidthd
by IP
Historical traffic
Bandwidthd
graphing
Protocol-level
Wireshark
troubleshooting
Malware/Anomaly Wireshark (with help
detection from Bandwidthd)

What Is Traffic Analysis?

Traffic analysis is the process of capturing, inspecting, and interpreting data as it travels
across a network. It helps:
 Identify bandwidth hogs
 Troubleshoot network performance
 Detect anomalies or malicious activity
 Understand application behavior and protocol usage

Week 7:
Traffic Measurement with Ntopng
ntopng is a powerful web-based network traffic monitoring tool that provides real-time and historical
visibility into what's happening on your network—ideal for bandwidth usage, flow analysis, and
detecting anomalies.

12
1. What is Ntopng?
 ntopng stands for “Next-Generation Ntop”.
 It is a web-based traffic analyzer using NetFlow/IPFIX/sFlow or packet capture.
 Shows top talkers, protocol usage, geolocation of IPs, active flows, and more.

sudo apt update

sudo apt install ntopng

wget [Link]
sudo apt-key add [Link]
sudo add-apt-repository [Link]
sudo apt update
sudo apt install ntopng
-i=eth0 # Interface to monitor
-w=3000 # Web interface port ([Link]
--local-networks="[Link]/24" # Define local subnet

sudo systemctl enable ntopng

sudo systemctl start ntopng
[Link]

4. Ntopng Web Interface Overview

Once logged in (default user: admin, password: admin), you get access to:

🔍 Dashboard

 Top IPs by bandwidth

 Real-time traffic charts
 Active hosts and flows

📊 Traffic Metrics

 Total and per-IP traffic

 Application protocol breakdown (HTTP, HTTPS, DNS, etc.)
 Inbound/outbound bandwidth

Week 8
Threat Modeling with OWASP Cornucopia

Threat Modeling with OWASP Cornucopia

OWASP Cornucopia is a creative, structured tool for threat modeling based on a card
game format. Developed by OWASP for Microsoft’s SDL (Security Development
Lifecycle), it's designed to help developers, testers, and security teams identify potential
security threats in web applications—especially during design or early development phases.

13
1. What is OWASP Cornucopia?
 A gamified threat modeling tool
 Based on a deck of cards, each representing a security threat or concern
 Primarily focused on web application security
 Encourages collaboration and conversation around secure design
🃏 Think of it like a security-themed poker deck, but for brainstorming threats.

2. What's in the Cornucopia Deck?

The deck is divided into 6 suits, each focusing on a specific aspect of web app security.
Each card includes:
 A threat scenario
 A description
 Related OWASP Top 10 references
 Prompt questions to stimulate discussion

Suit Focus Area

A – Authentication Issues with login, credentials, session management
B – Authorization Access control, privilege escalation
C – Session Management Tokens, timeouts, session fixation
D – Data Validation and Encoding Injection, XSS, output encoding
E – Cryptography Encryption, key management, password storage
F – File and Resources File uploads, path traversal, external resources

How to Use OWASP Cornucopia

🧠 Step-by-Step Process
1. Gather the Right Team

 Developers
 QA testers
 Security specialists
 Product owners or system architects
This works best in small, cross-functional groups (4–8 people).

2. Choose a Component or Feature

 Example: "User Login", "Password Reset", or "Admin Dashboard"

3. Draw Cards & Discuss

 Shuffle and deal a few cards from each suit (or pick one suit per session).
 For each card:
o Read the threat scenario
o Ask: “Can this happen in our system?”
o If yes, record the threat and mitigation ideas.

14
4. Document Threats

 Use a simple table or spreadsheet to track:

o Threat name
o Affected feature
o Risk (e.g., Low/Medium/High)
o Suggested mitigations
o OWASP category

Week 9 :
Risk Assessment with OpenVAS

What is OpenVAS?
 Part of the Greenbone Vulnerability Management (GVM) framework.
 Scans systems for:
o Known vulnerabilities (CVEs)
o Misconfigurations
o Outdated software
 Helps perform a risk-based assessment by scoring vulnerabilities (CVSS-based).
 Provides actionable reports for remediation.
✅ Great for security teams, sysadmins, and IT auditors.

Feature Description
✅ Vulnerability Scanning Full system and network scans
📄 CVSS Scoring Rates risk using CVSS (3.x)
📁 Comprehensive Reports HTML, PDF, XML formats
🔄 Regular Feed Updates Greenbone Community Feed for CVEs
🔐 Credentialed Scans Deeper insights using system credentials
🎯 Target Profiling OS, services, ports, known exploits
🧩 Integration Works with SIEMs and ticketing systems (via APIs)

Week 10 :
Firewall Configuration with pfSense

Firewall Configuration with pfSense

pfSense is an open-source firewall and router distribution based on FreeBSD, widely used in
enterprise and home networks for advanced firewalling, VPN, and routing capabilities.
This guide will walk you through how to configure and manage firewall rules in pfSense
for effective network security and traffic control.

1. What Is pfSense?
 A stateful packet filtering firewall
 Includes routing, NAT, VPN, IDS/IPS, and more
 Managed via an intuitive web GUI
 Suitable for:

15
 o Home labs and small business networks
o Enterprise edge or internal segmentation

Initial Setup (Optional Recap)

If you're just starting with pfSense:
 Download from [Link]
 Install on a dedicated appliance or VM
 Configure:
o WAN interface (external)
o LAN interface (internal)
Once configured, access the web interface via LAN IP (usually [Link])

3. Understanding pfSense Firewall Rules

📌 Key Concepts

 Rules are interface-specific (LAN, WAN, etc.)

 pfSense processes rules top to bottom, first match wins
 Rules apply to incoming traffic on an interface
 Default deny: If no rule matches, traffic is blocked

Interface Rule
LAN Allows all outbound traffic
WAN Blocks all unsolicited inbound traffic
Field Description
Action Pass / Block / Reject
Interface Where traffic comes in
Protocol TCP / UDP / ICMP / any
Source Who’s sending the traffic
Destination Target IP or network
Port Range e.g., 80 (HTTP), 443 (HTTPS)
Description Always add meaningful notes

Week 11:
Network Discovery with Nmap

Network Discovery with Nmap

Nmap is the go-to tool for network discovery and reconnaissance. It can discover hosts,
identify open ports, determine services and versions, fingerprint OSes, run
vulnerability/auxiliary scripts, and export results for later analysis. Below is a practical,
compact guide with commands, workflows, and safety/legal notes.

Quick reference — common options

 -sS — TCP SYN (stealth) scan

16
 -sT — TCP connect() scan (no raw sockets)
 -sU — UDP scan
 -sP / -sn — host discovery (ping sweep; no port scan)
 -p — specify ports (e.g. -p 1-65535 or -p 22,80,443)
 -A — aggressive (OS detect, version, scripts, traceroute)
 -O — OS detection
 -sV — service/version detection
 -T0..-T5 — timing (0 slowest/stealthy → 5 fastest/noisy)
 -Pn — skip host discovery (treat all targets as up)
 --open — show only hosts with open ports
 -oN/-oX/-oG/-oA — output formats: normal, XML, greppable, all
 --script — run NSE scripts (e.g. --script vuln or specific scripts)
 --top-ports — scan top N most common ports (e.g. --top-ports 100)

17