PRACTICE LAB 2

Network Traffic Capture & Protocol Analysis

Launch the Wireshark GUI tool, execute packet captures with tcpdump on local virtual adapters, verify protocol encapsulations, map OSI layer segments, and filter for anomalous cleartext flows.

Environment

Kali Linux Terminal / Wireshark

Difficulty

Beginner (Level 2)

Course Module

Networking & Packet Analysis

Deliverables

Annotated PCAP & Capture Report

1. System Architecture & Workflow

The diagram below represents the encapsulation flow. Data generated at the Application Layer (DNS/HTTP) is packaged inside a Transport segment (UDP/TCP headers), wrapped in a Network packet (IP source/destination), and loaded into a Data Link frame (MAC physical addresses) to traverse the wire.

2. Part 1: Step-by-Step Action Items & Key Execution Steps

STEP 1

Launch Wireshark GUI and Select the Capture Interface

Open Wireshark under root privilege and select the guest ethernet adapter connected to the isolated network segment.

Log in to your Kali Linux VM.
Click the application menu icon in the top-left corner (represented by the Kali dragon icon).
Type wireshark in the search bar.
Right-click Wireshark and select Run as Root or open a terminal and run the command below to launch with permissions.

$ sudo wireshark &

This command runs the Wireshark GUI analyzer as a background process with root permissions, which is necessary to put the virtual network card into promiscuous capture mode.

In the Wireshark welcome screen, locate the list of active network adapters.
Find the interface named eth0 (the primary guest interface configured on 192.168.56.0/24 Host-Only network).
Double-click on eth0 to start recording real-time network frames. Notice the empty packet list window begin to display activity.

STEP 2

Generate Traffic Streams and Apply Wireshark Display Filters

Generate traffic with native terminal tools and write display filters to isolate specific network protocols.

Keep Wireshark capturing in the background, and open a new terminal window.
Run the commands below to generate traffic (ARP requests, DNS queries, and cleartext HTTP requests).

$ ping -c 3 192.168.56.20

This command sends ICMP request/response streams to the target VM, triggering ARP broadcasts beforehand to resolve MAC addresses on the local link.

$ nslookup google.com 192.168.56.1

This command forces a DNS resolution request to the host gateway virtual IP to generate UDP/53 packet logs.

$ curl http://example.com

This command triggers a cleartext HTTP session request over TCP port 80, transferring server payload strings unencrypted.

Return to the Wireshark window.
Click the red square button in the top-left toolbar to stop active packet capture.
Locate the green filter bar at the top of the interface labeled Apply a display filter....
Type dns and press Enter. Notice the list filters to show only DNS traffic. Double-click a DNS packet and expand the details to inspect the query string.
Type arp in the filter bar and press Enter to inspect MAC resolution queries.
Type http in the filter bar and press Enter to inspect HTTP requests.

STEP 3

Capture Packet Streams with tcpdump

Utilize command-line packet sniffing utilities to capture network streams and write them to a local capture file.

In the Kali terminal, run the command below to launch a capture session targeting the eth0 interface.

$ sudo tcpdump -i eth0 -c 10 -w /home/student/Downloads/capture.pcap

This command binds tcpdump to interface eth0, captures exactly 10 packets, and outputs the raw payload data to a file named capture.pcap.

Part	What It Does
`tcpdump`	A command-line packet analyzer that captures network traffic in real-time
`-i`	Case-insensitive search
`-c`	Count — specifies the number of ping packets to send (Linux only)
`-w`	Write — saves captured packets to a file (pcap format) for later analysis

2. While the command is running, open another terminal tab and ping the host adapter gateway to generate packets: ping -c 3 192.168.56.1.

3. Once tcpdump terminates, read the raw capture output using the command below:

$ tcpdump -r /home/student/Downloads/capture.pcap -n

This command reads the local capture.pcap file, displaying packet timestamps and IP links without resolving names to IP addresses (improving scan execution speed).

STEP 4

Inspect and Trace OSI Layers in Wireshark

Deconstruct a single packet in the Wireshark GUI detail inspector, mapping each structural block to its respective OSI layer.

Launch Wireshark, click on File -> Open, and load /home/student/Downloads/capture.pcap.
Select the first packet in the list (e.g., an ICMP Echo Request).
Look at the middle panel (Packet Details). Identify the following collapsible trees:
- Frame: Corresponds to OSI Layer 1 (Physical), detailing physical frame size and timestamps.
- Ethernet II: Corresponds to OSI Layer 2 (Data Link), containing source and destination MAC addresses.
- Internet Protocol Version 4: Corresponds to OSI Layer 3 (Network), containing source and destination IP addresses.
- Transmission Control Protocol or User Datagram Protocol: Corresponds to OSI Layer 4 (Transport), showing source and destination ports.
- Domain Name System (response): Corresponds to OSI Layer 7 (Application), showing application query payload values.

3. Automation Architecture

The diagram below highlights the packet capture workflow. Test traffic is generated inside the terminal, intercepted by the libpcap driver, recorded to local pcap files, filtered using Wireshark display filters, and inspected to analyze headers.

4. Part 2: Complete Deliverable Assets & Production Templates

To automate traffic inspection and check for vulnerable cleartext protocols (like HTTP, Telnet, or FTP), you will implement a capture and parse utility script. Below is a step-by-step breakdown of how this script is constructed, followed by the final combined script.

Step-by-Step Script Construction

Step 1

Set Environment Variables & Define Capture Parameters

Establish script safety flags and set directories for recording output files.

#!/usr/bin/env bash set -euo pipefail CAP_FILE="/home/student/Downloads/live_traffic.pcap" CAP_DURATION="10"

This defines the shell interpreter path, sets error-exit triggers, and points local memory addresses to the pcap output location.

Step 2

Execute Background Capture Operations

Run tcpdump to log network traffic packets for a specified time frame.

echo "Starting traffic capture on eth0 for ${CAP_DURATION} seconds..." sudo tcpdump -i eth0 -w "${CAP_FILE}" & TCPDUMP_PID=$! sleep "${CAP_DURATION}" sudo kill "${TCPDUMP_PID}"

This runs tcpdump as a background job, records traffic logs, registers the PID, waits, and kills the sniffer process to stop capturing.

Part	What It Does
`sudo`	SuperUser Do — executes the following command with root (administrator) privileges
`tcpdump`	A command-line packet analyzer that captures network traffic in real-time
`-i`	Case-insensitive search
`-w`	Write — saves captured packets to a file (pcap format) for later analysis
`stop`	Gracefully stops a running container

Step 3

Scan PCAP for Unencrypted Protocols

Inspect raw packet headers in the saved PCAP file to detect insecure protocols.

tcpdump -r "${CAP_FILE}" -n 'tcp port 80 or tcp port 21 or tcp port 23' > plain.log || true if [ -s plain.log ]; then echo "[ALERT] Unencrypted protocols (HTTP/FTP/Telnet) detected in stream!" else echo "[SUCCESS] No cleartext protocol signatures observed." fi

This parses the capture file using port filters, logs any matches, and outputs alert flags if insecure HTTP (80), FTP (21), or Telnet (23) traffic exists.

Part	What It Does
`-r`	Recursive — search all files in subdirectories
`-n`	Numeric output — show port numbers instead of resolving service names

Combined Automated Script

Save the consolidated script code below inside your Kali Linux VM as /home/student/Scripts/sniff_and_audit.sh, adjust executable permissions, and run the sniffer:

$ chmod +x /home/student/Scripts/sniff_and_audit.sh && /home/student/Scripts/sniff_and_audit.sh

This command grants execution permissions to the script file and executes the packet sniffer and parser checks in the shell.

Code Breakdown — Line by Line

Copy

Line 1: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

#!/usr/bin/env bash

Line 2: This is a comment that describes what the code does: "!/usr/bin/env bash". Comments start with # and are ignored by Python.

# sniff_and_audit.sh - Packet Capture and Unencrypted Protocol Scanner

Line 3: This is a comment that describes what the code does: "sniff_and_audit.sh - Packet Capture and Unencrypted Protocol Scanner". Comments start with # and are ignored by Python.

set -euo pipefail

Line 4: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

INTERFACE="eth0"

Line 5: Creates a variable called INTERFACE and assigns a value to it. Variables store data for use later in the program.

OUTPUT_PCAP="/home/student/Downloads/live_traffic.pcap"

Line 6: Creates a variable called OUTPUT_PCAP and assigns a value to it. Variables store data for use later in the program.

DURATION="15"

Line 7: Creates a variable called DURATION and assigns a value to it. Variables store data for use later in the program.

REPORT_LOG="./sniff_report.txt"

Line 8: Creates a variable called REPORT_LOG and assigns a value to it. Variables store data for use later in the program.

echo "========================================"

Line 9: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

echo "NETWORK TRAFFIC SNIFFER & PROTOCOL AUDIT"

Line 10: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

echo "========================================"

Line 11: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

echo "Target Interface: ${INTERFACE}"

Line 12: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

echo "Capture Duration: ${DURATION} seconds"

Line 13: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

echo "Output Destination: ${OUTPUT_PCAP}"

Line 14: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

echo "----------------------------------------"

Line 15: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

# Initialize report

Line 16: This is a comment that describes what the code does: "Initialize report". Comments start with # and are ignored by Python.

echo "=== Packet Sniffer Report ===" > "${REPORT_LOG}"

Line 17: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

# Start tcpdump sniffer in background

Line 18: This is a comment that describes what the code does: "Start tcpdump sniffer in background". Comments start with # and are ignored by Python.

echo "[*] Activating packet capture engine..."

Line 19: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

sudo tcpdump -i "${INTERFACE}" -w "${OUTPUT_PCAP}" >/dev/null 2>&1 &

Line 20: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

✓ Complete Combined Script: All lines explained above are combined into the full script shown below. Copy and paste the entire script into your file.

Copy

#!/usr/bin/env bash
# sniff_and_audit.sh - Packet Capture and Unencrypted Protocol Scanner

set -euo pipefail

INTERFACE="eth0"
OUTPUT_PCAP="/home/student/Downloads/live_traffic.pcap"
DURATION="15"
REPORT_LOG="./sniff_report.txt"

echo "========================================"
echo "NETWORK TRAFFIC SNIFFER & PROTOCOL AUDIT"
echo "========================================"
echo "Target Interface: ${INTERFACE}"
echo "Capture Duration: ${DURATION} seconds"
echo "Output Destination: ${OUTPUT_PCAP}"
echo "----------------------------------------"

# Initialize report
echo "=== Packet Sniffer Report ===" > "${REPORT_LOG}"

# Start tcpdump sniffer in background
echo "[*] Activating packet capture engine..."
sudo tcpdump -i "${INTERFACE}" -w "${OUTPUT_PCAP}" >/dev/null 2>&1 &
SNIFFER_PID=$!

# Generate background packets during capture window
sleep 2
ping -c 3 192.168.56.1 >/dev/null 2>&1 || true
curl http://example.com >/dev/null 2>&1 || true

echo "[*] Capturing packet data streams..."
sleep "${DURATION}"

# Stop the background sniffer process safely
echo "[*] Stopping capture engine..."
sudo kill "${SNIFFER_PID}" >/dev/null 2>&1 || true
wait "${SNIFFER_PID}" 2>/dev/null || true

echo "[+] Capture completed successfully."
echo "----------------------------------------"
echo "[*] Running Cleartext Protocol Scan..."

# Audit pcap for unencrypted HTTP (80), Telnet (23), and FTP (21) connections
TEMP_LOG="cleartext_matches.tmp"
tcpdump -r "${OUTPUT_PCAP}" -n 'tcp port 80 or tcp port 23 or tcp port 21' > "${TEMP_LOG}" 2>/dev/null || true

if [ -s "${TEMP_LOG}" ]; then
  echo "[CRITICAL WARNING] Unencrypted protocols identified!" | tee -a "${REPORT_LOG}"
  cat "${TEMP_LOG}" >> "${REPORT_LOG}"
  echo "See details in: ${REPORT_LOG}"
else
  echo "[SUCCESS] Secure state: No unencrypted HTTP/FTP/Telnet data frames detected." | tee -a "${REPORT_LOG}"
fi

rm -f "${TEMP_LOG}"
echo "========================================"

5. Deliverables Summary

Students must produce and submit the following artifacts to verify completion of this training lab.

Created Files / Configs

Saved traffic trace file: /home/student/Downloads/live_traffic.pcap
/home/student/Scripts/sniff_and_audit.sh - Captured automated auditing shell script
sniff_report.txt - Vulnerability protocol detection log report

Verification Artifacts / Execution Proof

Wireshark screenshot showing an expanded collapsible tree mapping the frame layer to the OSI model.
Wireshark display filter screenshot showing isolated DNS/HTTP packet summaries.
Output logs confirming discovery of unencrypted traffic traces in the capture.

6. Closing Explanation: Why We Did This & What It Accomplishes

Architectural Intent & Operational Impact

Why We Did This

Analyzing data encapsulation clarifies how header properties route data, confirming that a configuration error at one layer (e.g. invalid MAC addresses at Layer 2) breaks transport paths above.
Scanning for cleartext protocols in network traces highlights compliance vulnerabilities, demonstrating how easily attackers can capture sensitive authentication variables if unencrypted options like HTTP or Telnet are deployed.
Developing tcpdump bash scripting workflows automates traffic logging, enabling head-free diagnostic captures on headless servers.

What This Accomplishes

Builds core competency in network traffic packet capture analysis.
Familiarizes students with Wireshark and tcpdump interface selectors, capturing flags, and filter variables.
Establishes baseline network health checking routines to support intrusion detection deployment in later projects.