CN Lab
CN Lab
1. Study different types of Network cables (Copper and Fiber) and prepare cables
(Straight and Cross) to connect Two or more jacks. Use LAN tester to connect the cables.
- Install and configure Network Devices: HUB, Switch and Routers. Consider both manageable
and non-manageable switches. Do the logical configuration of the system. Set the bandwidth
of different ports.
- Install and Configure Wired and Wireless NIC and transfer files between systems in Wired
LAN and Wireless LAN. Consider both adhoc and infrastructure mode of operation.
2. Work with the commands Ping, Tracert, Ipconfig, pathping Hostname, Nbtstat, netdiag,
and Nslookup
3. Find all the IP addresses on your network. Unicast, Multicast, and Broadcast on your
network.
4. Use Packet tracer software to build network topology and configure using Distance
vector routing protocol.
5. Use Packet tracer software to build network topology and configure using Link State
routing protocol.
6. Using JAVA RMI Write a program to implement Basic Calculator.
7. Implement a Chatting application using JAVA TCP and UDP sockets.
8. Hello command is used to know whether the machine at the other end is working or
not. Echo command is used to measure the round-rip time to the neighbor. Implement Hello
and Echo commands using JAVA.
9. Using Wireshark perform the following operations:
- Inspect HTTP Tra
- Inspect HTTP Traffic from a Given IP Address,
- Inspect HTTP Traffic to a Given IP Address,
- Reject Packets to Given IP Address,
- Monitor Apache and MySQL Network Traffic
1. Study different types of network cables (copper and fiber)and prepare
cables (straight and cross) to connect two or more systems. use crimping
tool to connect jacks. use LAN tester to connect the cables
The primary types of cables used for connecting systems in a network are copper cables and
fiber optic cables. Each type of cable has distinct characteristics, and there are different
wiring standards (such as straight-through and crossover) for connecting devices.
1. Types of Network Cables
• Copper Cables (e.g., Ethernet cables)
o Unshielded Twisted Pair (UTP): This is the most common type of copper
cable. It contains multiple pairs of twisted wires that help reduce
electromagnetic interference (EMI).
Installation:
Plug the hub into a power source.
Connect devices to the hub using Ethernet cables.
Ensure the devices are powered on and connected properly.
Configuration:
Non-manageable Hub: A hub typically requires no configuration; it is a simple plug-and-play
device.
Manageable Hub: Some hubs may allow basic configuration (though this is more common
with switches and routers). Configuration could involve settings like port mirroring or
monitoring, which would be done via a web interface or command line.
b. Switch
A Switch operates at the Data Link Layer and can intelligently forward data only to the
device that needs it, which improves network efficiency.
Installation:
Plug the switch into a power source.
Connect Ethernet cables from each device to the switch.
Ensure all devices are powered on.
Configuration:
Non-manageable Switch: Like the hub, a non-manageable switch is also plug-and-play and
requires no configuration.
Manageable Switch: Manageable switches provide more advanced features, such as VLANs,
port security, and QoS. To configure it:
Access the switch interface: Use a web interface or command line via Telnet or SSH.
Configure VLANs: You can segment network traffic by creating Virtual Local Area Networks
(VLANs).
Set up port security: This can prevent unauthorized devices from connecting.
Enable QoS: Set up Quality of Service to prioritize critical traffic (e.g., VoIP).
Save configuration: Once done, save the changes to prevent loss after a reboot.
c. Router
A Router is a device that connects different networks (usually a local network to the internet)
and directs data between them. Routers operate at the Network Layer.
Installation:
Connect the router to a power source.
Connect one Ethernet cable from the router’s WAN port to your modem (for internet
connectivity).
Connect the LAN ports of the router to devices or a switch for internal network connectivity.
Configuration:
Access the router’s configuration page: This is typically done via a browser. Type the router's
default IP address (e.g., 192.168.1.1) in the address bar.
Login: Use the default credentials (often found on the router’s label).
Set up the router’s internet connection: This may involve entering details provided by your
ISP (e.g., PPPoE, dynamic IP).
Configure the wireless settings (for routers with Wi-Fi):
Enable Wi-Fi and set the SSID (network name).
Choose the security type (WPA2 is recommended).
Set a strong password.
Configure routing settings: Set up static or dynamic routes if necessary, depending on your
network.
Enable DHCP: The router can automatically assign IP addresses to devices on the network
(typically enabled by default).
Save configuration.
2. Installing and Configuring Wired and Wireless NICs (Network Interface Cards)
a. Wired NIC Installation and Configuration
Installation:
Install the NIC: Insert the wired NIC into the computer's PCIe slot (for desktop) or connect
the Ethernet port (for laptop).
The operating system will usually automatically detect and install the necessary drivers. If
not, use the driver CD or download the driver from the manufacturer’s website.
Configuration:
Static IP: In the Network Settings on Windows or Linux, set a static IP address if required.
For example, in Windows:
Go to Control Panel > Network and Sharing Center > Change adapter settings.
Right-click the network connection, select Properties, then click Internet Protocol Version 4
(TCP/IPv4) and set the IP address, subnet mask, and gateway.
DHCP: Ensure the NIC is set to automatically obtain an IP if your router assigns addresses
dynamically.
b. Wireless NIC Installation and Configuration
Installation:
Install the Wireless NIC: Insert the wireless card into the appropriate slot or use a USB Wi-Fi
adapter.
Install the drivers: The operating system will usually detect the card and install the necessary
drivers automatically. If not, use the provided driver disk or download them from the
manufacturer’s website.
Configuration:
Wireless Network Setup: Connect to an available wireless network from the network icon in
the system tray (Windows) or Wi-Fi settings (Mac/Linux).
Enter SSID and Password: Choose your network and enter the Wi-Fi password.
Check Connection: Once connected, verify connectivity by opening a browser or pinging the
gateway.
3. File Transfer Between Systems
a. Wired LAN File Transfer
File Sharing on Windows:
Enable file sharing: Right-click the folder you want to share, select Properties, then click the
Sharing tab and select Share.
Access the Shared Folder: On another computer, open File Explorer, type \\<IP address> in
the address bar to access the shared folder.
File Sharing on Linux:
Use Samba or NFS to share files between systems.
Share a folder using samba configuration or Samba GUI.
b. Wireless LAN File Transfer
Ad-hoc Mode (Direct Wireless Connection):
In Ad-hoc mode, devices connect directly to each other, without a router or access point.
Windows: Create an ad-hoc network by going to Control Panel > Network and Sharing
Center > Set up a new connection or network and select Set up an ad-hoc network. Devices
can connect to each other by selecting the ad-hoc network name and entering the password.
Linux: Use tools like nmcli or NetworkManager to create an ad-hoc network.
Infrastructure Mode (Via Router or Access Point):
In Infrastructure mode, devices connect to a central router or access point, which then routes
traffic between them.
Windows: Set up a connection to the wireless network and use file sharing as explained
above.
Linux: Similar to the wired LAN setup, connect to the network and share files via Samba or
NFS.
4. Testing and Verifying Connectivity
Ping Test: After setting up devices, use the ping command to check connectivity between
devices in the network.
Example: Open a command prompt and type ping <IP address> to verify if the device is
reachable.
File Transfer: Try transferring files to verify the connection. For wireless setups, ensure both
devices are on the same network (either Ad-hoc or Infrastructure mode).
2. Work with the commands Ping, Tracert, Ipconfig, pathping, telnet, ftp,
getmac, ARP, Hostname, Nbtstat, netdiag, and Nslookup
1. Ping
• Purpose: Tests network connectivity by sending ICMP Echo Request packets to a
target (IP address or domain name) and waits for an Echo Reply.
• Syntax: ping [target]
Example:
bash
ping google.com
ping 192.168.1.1
Output: Displays the round-trip time for packets sent and received. If the target is
unreachable, it will show a timeout.
2. Traceroute
• Purpose: Traces the route taken by packets from your system to the target (IP address
or domain), showing each hop along the way.
• Syntax: Traceroute [target]
Example:
bash
Traceroute google.com
Traceroute 8.8.8.8
Output: Lists each hop (router) and the time it took to reach it.
3. Ipconfig
• Purpose: Displays the network configuration of your computer (IP addresses, subnet
mask, gateway, etc.).
• Syntax: ipconfig (basic), ipconfig /all (detailed)
Example:
bash
ipconfig
ipconfig /all
Output: Displays network interfaces, IP addresses, DNS servers, etc.
4. Pathping
• Purpose: Combines the features of ping and tracert by providing the route taken to a
target and the latency at each hop. It also provides packet loss statistics.
• Syntax: pathping [target]
Example:
bash
pathping google.com
pathping 192.168.2.1
Output: Similar to traceroute, but with packet loss and latency statistics for each hop.
5. Telnet
• Purpose: Connects to a remote system or device via the Telnet protocol, typically
used for remote terminal access. It is often used for troubleshooting port connectivity.
• Syntax: telnet [host] [port]
Example:
bash
telnet 192.168.2.1 80
telnet google.com 443
Output: If the connection is successful, a blank screen appears or a service banner is
displayed (e.g., HTTP server response). If the connection fails, you’ll see an error message.
9. Hostname
• Purpose: Displays or sets the hostname of the computer.
• Syntax: hostname
Example:
bash
hostname
Output: Displays the current hostname of the machine.
10. Nbtstat
• Purpose: Displays NetBIOS over TCP/IP statistics and the NetBIOS name table.
• Syntax: nbtstat [command]
Example:
bash
nbtstat -n
nbtstat -A 192.168.2.1
Output: Displays NetBIOS information for local machine or remote system.
11. Netdiag
• Purpose: A diagnostic tool in Windows that provides network diagnostics, especially
for detecting and troubleshooting network problems.
• Syntax: netdiag
Example:
bash
netdiag
Output: Displays detailed information on network connections, including errors or issues
found.
12. Nslookup
• Purpose: Queries DNS servers to obtain domain name or IP address information.
• Syntax: nslookup [domain]
Example:
bash
nslookup google.com
nslookup 8.8.8.8
Output: Displays the DNS information for the specified domain or IP.
3.Find all the IP addresses on your network. Unicast, Multicast, and
Broadcast on your network
Understanding the Types of IP Addresses
• Unicast: A one-to-one communication. This is the most common type of IP address,
used for communication between a specific device and another specific device.
Examples are your computer talking to a web server.
• Multicast: One-to-many communication, where data is sent to a specific group of
devices that have joined a particular multicast group. Examples include video
streaming, group messaging, and some network discovery protocols.
• Broadcast: One-to-all communication within a specific network. Data is sent to all
devices on the local network segment. Examples include DHCP requests, ARP
broadcasts.
How to Find IP Addresses on Your Network (Using Your Computer)
The methods vary slightly depending on your operating system:
1. Unicast IP Addresses (Your Devices on the Network)
• Windows:
1. Using ipconfig:
▪ Open Command Prompt (search for "cmd").
▪ Type ipconfig /all and press Enter.
▪ Look for the following:
▪ "Ethernet adapter Ethernet" (if wired connection)
or "Wireless LAN adapter Wi-Fi" (if wireless connection).
▪ "IPv4 Address": This is your computer's unicast IP address.
▪ "Subnet Mask": This helps define your local network.
▪ "Default Gateway": This is the IP address of your router.
2. Using Network Settings GUI:
▪ Open Settings (Win + I).
▪ Go to "Network & Internet".
▪ Click on "Ethernet" or "Wi-Fi", depending on your connection.
▪ Click on "Properties".
▪ Your IP address information will be displayed.
• macOS:
1. Using ifconfig (Terminal):
▪ Open Terminal (search for "Terminal").
▪ Type ifconfig and press Enter.
▪ Look for en0 (for wired Ethernet) or en1 (for Wi-Fi, may be different).
▪ The inet line will show your computer's unicast IPv4 address (e.g., inet
192.168.1.10). The netmask is your subnet mask.
▪ The router address can often be found in route get default | grep
gateway
2. Using Network Settings GUI:
▪ Click the Apple menu and select "System Settings" (or "System
Preferences").
▪ Click "Network".
▪ Select your active network interface (Ethernet or Wi-Fi).
▪ The IP address and subnet mask will be displayed.
• Linux:
1. Using ifconfig or ip addr (Terminal):
▪ Open a terminal.
▪ Type ifconfig (older systems) or ip addr (newer systems) and press
Enter.
▪ Look for your active interface (often eth0, wlan0, or enp0s3, etc.).
▪ With ifconfig, the inet addr line will show the IPv4 address. With ip
addr, look for the inet line under your interface.
▪ The router address can often be found in ip route show default | grep
gateway
2. Using GUI
▪ Open your system's network manager (typically through settings) and
check the connection details for your chosen interface.
2. Finding Other Devices' Unicast IP Addresses on Your Local Network
• Using arp:
o The Address Resolution Protocol (arp) maps IP addresses to physical (MAC)
addresses on a local network. You can use this to see what other devices your
computer is aware of.
o Windows (Command Prompt): arp -a
o macOS or Linux (Terminal): arp -a
o The output will show the IP addresses (and corresponding MAC addresses) of
other devices your computer has recently communicated with.
o Note: arp only works with devices on your local broadcast domain.
• Using a Network Scanner (Nmap):
o A network scanner can actively scan your network and find devices. nmap is a
powerful and popular tool.
o Install nmap (using your OS's package manager or from the website):
▪ Linux (Debian/Ubuntu): sudo apt install nmap
▪ macOS: brew install nmap (if you have Homebrew) or install from the
Nmap website.
▪ Windows: Download from the Nmap website.
o Scan your network (Terminal):
▪ nmap -sn <your_network_address>/<cidr_prefix>
▪ Example, if you subnet is 192.168.2.0/24, use: nmap -sn
192.168.2.0/24. This will identify all devices on your subnet and
output their IP addresses.
3. Multicast IP Addresses
• Multicast addresses are in the range of 224.0.0.0 to 239.255.255.255.
• Specific Multicast Addresses:
o 224.0.0.1: All systems on the subnet.
o 224.0.0.2: All routers on the subnet.
o There are other specific multicast addresses related to different protocols.
• How to Find Multicast Activity:
o You can use tools like tcpdump or Wireshark to capture network traffic, and
then analyze to look for multicast packets.
o Example (Linux/macOS, in Terminal): sudo tcpdump -i <interface>
multicast
▪ Replace <interface> with your network interface (eth0, wlan0, etc.)
• Note: You likely won't see a list of "multicast IP addresses" in the way you see
unicast IPs. Instead, you'd see traffic using multicast addresses. You typically need
specialized tools to find devices using multicast protocols, and also, be aware of
multicast traffic on your network.
4. Broadcast IP Addresses
• The broadcast address is usually the last address in your network segment (determined
by your subnet mask).
• How to Find Your Broadcast Address:
1. Find your unicast IP address and subnet mask (using the methods above).
2. Convert the subnet mask to binary form.
3. Invert the binary form of the subnet mask and create the broadcast address
using bitwise OR operation of your unicast address with the inverted binary
form of subnet mask.
• Example:
o If your IP address is 192.168.2.10 and your subnet mask is 255.255.255.0:
▪ Subnet mask in binary: 11111111.11111111.11111111.00000000
▪ Inverted subnet mask in
binary: 00000000.00000000.00000000.11111111
▪ Broadcast address in binary: 11000000.10101000.00000001.11111111
▪ Broadcast address in decimal : 192.168.2.255
4. Use Packet tracer software to build network topology and configure
using Distance vector routing protocol.
To build a network topology and configure it using a Distance Vector Routing Protocol (such
as RIP) in Cisco Packet Tracer, follow these steps:
1. Assign IP Addresses:
o Click on each router and go to the CLI tab.
o Assign IP addresses to the interfaces (use a unique subnet for each link).
plaintext
CopyEdit
Router> enable
Router# configure terminal
Router(config)# interface gigabitEthernet 0/0
Router(config-if)# ip address 192.168.1.1 255.255.255.0
Router(config-if)# no shutdown
Router(config-if)# exit
o IP Address: 192.168.1.2
o Subnet Mask: 255.255.255.0
o Default Gateway: 192.168.1.1
1. Enable RIP on Routers: Configure RIP on all routers to share routing information
automatically.
plaintext
CopyEdit
Router> enable
Router# configure terminal
Router(config)# router rip
Router(config-router)# version 2
Router(config-router)# network 192.168.1.0
Router(config-router)# network 192.168.2.0
Router(config-router)# exit
Repeat for Router-1 and Router-2, adjusting the networks to match the topology.
2. Verify RIP Configuration: Use the following command on each router to check the
RIP routing table:
plaintext
CopyEdit
Router# show ip route
plaintext
CopyEdit
ping 192.168.x.x
o If pings succeed, the Distance Vector Routing protocol (RIP) is functioning
correctly.
plaintext
CopyEdit
Router# copy running-config startup-config
5. Use Packet tracer software to build network topology and configure
using Link State routing protocol.
Objective
To create a network topology and configure routers using OSPF (Open Shortest Path First)
protocol in Cisco Packet Tracer.
Example IP Scheme:
• Configure PCs with the IP address and gateway corresponding to the router.
Router 1:
plaintext
enable
configure terminal
router ospf 1
router-id 1.1.1.1
network 192.168.1.0 0.0.0.255 area 0
network 10.0.0.0 0.0.0.3 area 0
exit
write memory
Router 2:
plaintext
enable
configure terminal
router ospf 1
router-id 2.2.2.2
network 10.0.0.0 0.0.0.3 area 0
network 10.0.1.0 0.0.0.3 area 0
exit
write memory
Router 3:
plaintext
enable
configure terminal
router ospf 1
router-id 3.3.3.3
network 192.168.3.0 0.0.0.255 area 0
network 10.0.1.0 0.0.0.3 area 0
exit
write memory
plaintext
show ip ospf neighbor
plaintext
show ip route
plaintext
ping 192.168.3.x
plaintext
copy running-config startup-config
6.Using JAVA RMI Write a program to implement Basic Calculator.
The interface defines the methods that the remote calculator supports.
import java.rmi.Remote;
import java.rmi.RemoteException;
java
import java.rmi.RemoteException;
import java.rmi.server.UnicastRemoteObject;
@Override
public double add(double a, double b) throws RemoteException {
return a + b;
}
@Override
public double subtract(double a, double b) throws RemoteException {
return a - b;
}
@Override
public double multiply(double a, double b) throws RemoteException {
return a * b;
}
@Override
public double divide(double a, double b) throws RemoteException {
if (b == 0) {
throw new ArithmeticException("Division by zero is not allowed.");
}
return a / b;
}
}
The server registers the Calculator service with the RMI registry.
java
import java.rmi.Naming;
import java.rmi.registry.LocateRegistry;
java
import java.rmi.Naming;
// Perform calculations
System.out.println("Addition: " + calculator.add(10, 5));
System.out.println("Subtraction: " + calculator.subtract(10, 5));
System.out.println("Multiplication: " + calculator.multiply(10, 5));
System.out.println("Division: " + calculator.divide(10, 5));
} catch (Exception e) {
System.err.println("Client exception: " + e.getMessage());
e.printStackTrace();
}
}
}
rmiregistry
java CalculatorServer
java CalculatorClient
Output
The client will display the results of the calculations:
plaintext
Addition: 15.0
Subtraction: 5.0
Multiplication: 50.0
Division: 2.0
7. Implement a Chatting application using JAVA TCP and UDP sockets.
To implement a chatting application using Java with TCP and UDP sockets, you can follow
these steps. Below is a guide for building both TCP and UDP socket-based chat applications.
A TCP chat application ensures reliable communication between the client and the server.
import java.io.*;
import java.net.*;
socket.close();
} catch (IOException e) {
e.printStackTrace();
}
}
}
import java.io.*;
import java.net.*;
A UDP chat application allows for faster but less reliable communication between a client
and a server.
while (true) {
socket.receive(packet);
String clientMessage = new String(packet.getData(), 0, packet.getLength());
System.out.println("Client: " + clientMessage);
if (clientMessage.equalsIgnoreCase("exit")) {
System.out.println("Client disconnected!");
break;
}
import java.net.*;
import java.util.Scanner;
if (message.equalsIgnoreCase("exit")) {
System.out.println("Disconnected from the server!");
break;
}
To implement Hello and Echo commands in Java, you can create a simple client-server
program using UDP sockets. Here’s how:
Concept Explanation
1. Hello Command:
o The client sends a "HELLO" message to the server.
o The server replies with "HELLO RECEIVED" to confirm it is working.
2. Echo Command:
o The client sends an "ECHO <message>" to the server.
o The server echoes the same message back to the client.
o The client measures the round-trip time (RTT).
Code Implementation
java
import java.net.*;
while (true) {
// Receive packet from client
serverSocket.receive(requestPacket);
String receivedMessage = new String(requestPacket.getData(), 0,
requestPacket.getLength());
System.out.println("Received: " + receivedMessage);
import java.net.*;
import java.util.Scanner;
while (true) {
System.out.print("Enter command (HELLO / ECHO <message> / exit): ");
String command = scanner.nextLine();
long startTime = 0, endTime;
// Exit condition
if (command.equalsIgnoreCase("exit")) {
System.out.println("Disconnected from server.");
break;
}
if (command.startsWith("ECHO")) {
double rtt = (endTime - startTime) / 1_000_000.0; // RTT in milliseconds
System.out.printf("Round-Trip Time: %.2f ms%n", rtt);
}
}
} catch (Exception e) {
e.printStackTrace();
}
}
}
Steps to Run
java HelloEchoServer
java HelloEchoClient
Output Example
Client:
plaintext
Enter command (HELLO / ECHO <message> / exit): HELLO
Server Response: HELLO RECEIVED
Enter command (HELLO / ECHO <message> / exit): ECHO Testing Echo Command
Server Response: Testing Echo Command
Round-Trip Time: 1.23 ms
Enter command (HELLO / ECHO <message> / exit): exit
Disconnected from server.
Server:
plaintext
Server is running and waiting for client...
Received: HELLO
Received: ECHO Testing Echo Command
Client disconnected.
9. Using Wireshark perform the following operations: - Inspect HTTP
Traffic
- Inspect HTTP Traffic from a Given IP Address,
- Inspect HTTP Traffic to a Given IP Address,
- Reject Packets to Given IP Address,
- Monitor Apache and MySQL Network Traffic.
Objectives
Background / Scenario
HyperText Transfer Protocol (HTTP) is an application layer protocol that presents data via a
web browser. With HTTP, there is no safeguard for the exchanged data between two
communicating devices.
With HTTPS, encryption is used via a mathematical algorithm. This algorithm hides the true
meaning of the data that is being exchanged. This is done through the use of certificates that
can be viewed later in this lab.
Regardless of HTTP or HTTPS, it is only recommended to exchange data with websites that
you trust. Just because a site uses HTTPS does not mean it is a trustworthy site. Threat actors
commonly use HTTPS to hide their activities.
In this lab, you will explore and capture HTTP and HTTPS traffic using Wireshark.
Required Resources
• CyberOps Workstation VM
• Internet connection
Instructions
tcpdump: listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
This command starts tcpdump and records network traffic on the enp0s3 interface.
The -i command option allows you to specify the interface. If not specified, the tcpdump will
capture all traffic on all interfaces.
The -s command option specifies the length of the snapshot for each packet. You should limit
snaplen to the smallest number that will capture the protocol information in which you are
interested. Setting snaplen to 0 sets it to the default of 262144, for backwards compatibility
with recent older versions of tcpdump.
The -w command option is used to write the result of the tcpdump command to a file. Adding
the extension .pcap ensures that operating systems and applications will be able to read to
file. All recorded traffic will be printed to the file httpdump.pcap in the home directory of the
user analyst.
Use the man pages for tcpdump to determine the usage of the -s and -w command options.
d. Open a web browser from the launch bar within the CyberOps Workstation VM. Navigate
to http://www.altoromutual.com/login.jsp
Because this website uses HTTP, the traffic is not encrypted. Click the Password field to see
the warning pop up.
e. Enter a username of Admin with a password of Admin and click Login.
f. Close the web browser.
g. Return to the terminal window where tcpdump is running. Enter CTRL+C to stop the
packet capture.
Step 3: View the HTTP capture.
The tcpdump, executed in the previous step, printed the output to a file named
httpdump.pcap. This file is located in the home directory for the user analyst.
a. Click the File Manager icon on the desktop and browse to the home folder for the
user analyst. Double-click the httpdump.pcap file, in the Open With dialog box scroll down
to Wireshark and then click Open.
b. In the Wireshark application, filter for http and click Apply.
c. Browse through the different HTTP messages and select the POST message.
d. In the lower window, the message is displayed. Expand the HTML Form URL Encoded:
application/x-www-form-urlencoded section.
What two pieces of information are displayed?
The uid of Admin and passw of Admin
e. Close the Wireshark application.
Part 2: Capture and View HTTPS Traffic
You will now use tcpdump from the command line of a Linux workstation to capture HTTPS
traffic. After starting tcpdump, you will generate HTTPS traffic while tcpdump records the
contents of the network traffic. These records will again be analyzed using Wireshark.
Step 1: Start tcpdump within a terminal.
a. While in the terminal application, enter the command sudo tcpdump –i enp0s3 –s 0 –w
httpsdump.pcap. Enter the password cyberops for the user analyst when prompted.
tcpdump: listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
This command will start tcpdump and record network traffic on the enp0s3 interface of the
Linux workstation. If your interface is different than enp0s3, please modify it when using the
above command.
All recorded traffic will be printed to the file httpsdump.pcap in the home directory of the
user analyst.
b. Open a web browser from the launch bar within the CyberOps Workstation VM. Navigate
to www.netacad.com.
Note: If you receive a “Secure Connection Failed” webpage it probably means the date and
time are incorrect. Update the day and time with the following command, changing to the
current day and time:
b. In the Wireshark application, expand the capture window vertically and then filter by
HTTPS traffic via port 443.
Enter tcp.port==443 as a filter, and click Apply.
c. Browse through the different HTTPS messages and select an Application Data message.