Experiment 1: Monitoring Network Traffic
Capturing and analyzing network traffic with Wireshark to detect patterns, anomalies and security issues
Experiment 1: Monitoring Network Traffic
Objective: To analyze and capture network traffic to identify patterns, detect anomalies, and assess overall network performance and security.
Procedure
Launching Wireshark
- Find Wireshark in your applications menu and launch it. You'll likely need administrative privileges to capture traffic.
Selecting an Interface
- Upon launching, Wireshark will show a list of available network interfaces (e.g., Ethernet, Wi-Fi). Select the interface through which your network traffic is flowing.
Clip: Launch & interface selection
Starting Capture
- Click the blue "Start capturing packets" fin icon (or Capture → Start) to begin capturing traffic on the selected interface.
Generating Traffic (for analysis)
- Perform some network activity: browse websites, ping another machine, transfer a file, or open an application that uses the network. This populates your capture with packets to analyze.
Stopping Capture
- Click the red "Stop capturing packets" square icon (or Capture → Stop) to halt the capture.
Clip: Generating and stopping a capture
Analyzing Captured Traffic
- Packet List Pane (Top): Shows a summary of each packet — number, time, source IP, destination IP, protocol, length, and info.
- Packet Details Pane (Middle): Expands the selected packet, showing the various layers of the network stack (Ethernet, IP, TCP/UDP, HTTP, etc.) and their details.
- Packet Bytes Pane (Bottom): Displays the raw hexadecimal and ASCII data of the selected packet.
- Filtering: Use the display filter bar at the top (e.g.
http,dns,ip.addr == 192.168.1.1,tcp.port == 80) to narrow down the displayed packets and focus on specific traffic.
Clip: Reading the three panes + applying a filter
Viva Questions
Q1: What is the purpose of monitoring network traffic? A1: To analyze data flow, detect anomalies, ensure network performance, and identify security threats like intrusions or data exfiltration.
Q2: Which tools are commonly used for network traffic monitoring? A2: Wireshark, tcpdump, Tshark, ntop, and Zeek (formerly Bro).
Q3: How can you differentiate between normal and abnormal traffic? A3: By comparing captured traffic against baseline patterns — e.g., unexpected ports, large data transfers, repeated failed logins, or unusual IP destinations.
Q4: What is a packet capture (PCAP)? A4: A PCAP is a file format used to store raw network traffic data captured from a network interface, analyzable with tools like Wireshark.
Q5: How can encrypted traffic affect monitoring? A5: Encrypted traffic (e.g., HTTPS) hides payload content, limiting visibility. Analysts may rely on metadata (IP, port, packet size, timing) for detection.
