55 Scanning and Enumeration – Sniffing Basics
Dante Rocca
Sniffing is an important task for any hacker or network administrator. It allows one to see the traffic going across the network and pick out important details such as active machines, IP and MAC addresses, and sometimes even passwords if unencrypted traffic is being sent.
Phase 0 – Professional Alignment
Understanding what is happening on a network requires the ability to capture and analyze network traffic. In this chapter, you will use Wireshark and tcpdump to observe network communications, apply packet filters, and examine common protocols such as HTTP and FTP. These activities develop essential troubleshooting and security analysis skills by helping you visualize how data moves across enterprise networks.
DCWF Work Roles
The knowledge and skills developed in this chapter align with the following Department of Defense Cyber Workforce Framework (DCWF) work roles:
- 541 – Cyber Defense Analyst
- 511 – Network Operations Specialist
- 451 – System Security Analyst
NICE Work Roles
This chapter supports competencies associated with the following NICE Workforce Framework for Cybersecurity work roles:
- Cyber Defense Analyst
- Network Operations Specialist
- Cyber Defense Infrastructure Support Specialist
Professional Skills
By completing this chapter, you will begin developing the ability to:
- Capture and analyze network traffic using Wireshark and tcpdump.
- Apply packet filters to isolate specific hosts, protocols, and network conversations.
- Interpret protocol behavior by examining captured packets.
- Identify unencrypted network communications and associated security risks.
- Compare graphical and command-line packet capture tools.
- Document packet capture findings to support troubleshooting and security investigations.
What You’ll Be Able to Do
After completing this chapter, you should be able to:
- Capture network traffic using Wireshark and tcpdump.
- Apply display filters to isolate HTTP, FTP, TCP, and host-specific traffic.
- Identify protocol fields and packet contents within captured network traffic.
- Demonstrate how unencrypted protocols expose sensitive information during transmission.
- Save and review packet capture files for later analysis.
- Explain how packet analysis supports enterprise network troubleshooting and cybersecurity investigations.
Learning Objectives
- Learn the basics of Wireshark filtering
Prerequisites
Deliverables
- Screenshot of Wireshark filtered to only TCP and FTP
- Screenshot of tcpdump capture on the command line
Resources
Contributors and Testers
- Mathew J. Heath Van Horn, PhD
- Jacob M. Christensen, Cybersecurity Student, ERAU-Prescott
Phase I – Generating Traffic to be seen on WireShark
To begin the lab, we’ll use Wireshark, which learners should already be familiar with. After generating some traffic, we’ll show how to use some basic filters.
- Open a Wireshark capture between the router and the switch on the network containing the Metasploitable VM
NOTE: Keep Wireshark running in the background. This section is all about generating interesting network traffic to examine later.
- Navigate to the Kali Linux VM
- Open the terminal and check its IP address
NOTE: In this example, our Kali IP address is 100.100.100.5.
> ip address show
- Perform an Nmap scan on the 200.200.200.0/24 network
> nmap 200.200.200.0/24
- In our example, we can see that our Metasploitable3-linux machine has an IP address of 200.200.200.7 and has FTP running on port 21
Figure 1 – Nmap scan results - Connect to the FTP service running on the Metasploitable VM
> telnet 200.200.200.7 21
- In the telnet terminal, log into the FTP server
user vagrant
pass vagrant
- Exit the FTP session
quit
Figure 2 – FTP login - Open Firefox and go to the following URL:
http://200.200.200.7/
- You can see that there are four web pages you can click on: Three folders and a Hypertext Pre-processor (PHP) file
Figure 3 – Results of Browser Visit - Click around on some of the various tabs on the webpage to generate traffic, then close the browser
- Open the terminal and check its IP address
Phase II – View traffic on wireshark and practice using filters
If you have ever observed Wireshark packet capture on a live connection, you can be easily overwhelmed by the thousands of data packets. In this book, we generally use a ‘closed’ system, so you may have only seen the packets of the tools we are using at the time. To separate the weeds from the wheat in a live environment, we need to learn to use filters. The most common filter on Wireshark is the display filter. We can use a combination of expressions and logical operators to filter which packets appear to us. The following are just some examples so you can gain practice using various display filters.
| Command | Meaning |
|---|---|
| != | Not equal |
| == | Equal |
| || | OR |
| && | AND |
Don’t worry about each packet type; you can Google that information and gain knowledge as you gain experience. However, don’t be afraid to click on any packet and explore.
- Now that some traffic has been generated, switch to the Wireshark window that was opened earlier. We’re going to apply some filters to look for certain kinds of traffic
- First, we’ll filter the capture to only show packets that involve the Kali VM (100.100.100.5)
ip.addr==100.100.100.5
Figure 4 – Filtering out all packets not from the Kali VM - That is too many packets for us to sift through. Let’s add to our current filter to only show HTTP traffic
ip.addr==100.100.100.5 && http
Figure 5 – Filtering on HTTP packets from the Kali VM - Now, we’ll use an “OR” operation to show both FTP and HTTP traffic
ip.addr==100.100.100.5 && http || ftp
- You can also see that the FTP login and passwords were passed in the clear
Figure 6 – Applying an HTTP or FTP filter to our target VM - Lastly, we’ll practice using a NOT operator to display all traffic not involving the Kali VM
ip.addr!=100.100.100.5
Figure 7 – All network traffic not used by our target machine
- First, we’ll filter the capture to only show packets that involve the Kali VM (100.100.100.5)
Phase III – tcpdump
While Wireshark is the tool of choice for sniffing, a wide variety of command-line sniffers exist, too. Tcpdump is the tool of choice in this category.
- Switch to the Kali VM and open the terminal
- To start tcpdump we need to know the different interfaces on our computer. Use the following command and take note of the interface connected on the GNS3 network
> ip address show
Figure 8 – Results of ip a - We can see there are two interfaces: Local (lo) and the ethernet (eth0). Use this information to start a basic tcpdump session
> sudo tcpdump -n -i eth0
Switch Description -i Specify the interface name we want to use. -n Do not convert addresses to names. - While tcpdump is running, generate traffic by opening a second terminal and connecting to the ftp server over telnet as we did in Phase I
- Once traffic has been generated, return to the original terminal and use Ctrl+C to stop tcpdump
Figure 9 – Results of tcpdump - Similar to Wireshark, we can use filters with tcpdump. To filter to only port 80 during a capture, use the following command and then generate traffic again by using Firefox to visit the same URL as in Phase I
> tcpdump -n -i eth0 port 80
- Use Ctrl+C to end the capture
- You can see that the information is rather difficult to read at first, but after a minute, you can see that it is very similar to the information we obtained from Wireshark
Figure 10 – Results of TCP dump filtered for HTTP traffic - One of the most important things to know is how to write a packet capture file with tcpdump. Use the following command to write a capture to a file. Use either the telnet connection or the browser to generate traffic
> tcpdump -n -i eth0 -w ~/Documents/CaptureFile.txt
- To view the saved file type cat ~/Documents/CaptureFile.txt. You can see the information is a little better since it is formatted for easy reading
Career Connection
Packet analysis is one of the most valuable skills for network engineers, systems administrators, and cybersecurity professionals. Whether diagnosing connectivity problems, validating network configurations, investigating security incidents, or identifying malicious activity, IT professionals routinely rely on Wireshark and tcpdump to observe network behavior at the packet level. The skills developed in this chapter reflect everyday operational tasks performed in enterprise environments, where packet captures often provide the evidence needed to resolve complex networking and security issues quickly and accurately.
End of Lab
Deliverables
2 screenshots are needed to earn credit for this exercise:
- Wireshark filtered on Metasploitable target machine showing only TCP and FTP
- TCPdump capture of Metasploitable target machine showing HTTP traffic
Homework Assignment 1 – Exploring Additional Protocols
During this chapter, you examined HTTP and FTP traffic. Enterprise networks, however, carry many different protocols that support normal business operations.
Instructions
Using Wireshark, capture network traffic while performing several common networking activities within your Eagle Net environment.
Perform at least four of the following:
- Ping another host.
- Browse a web page.
- Connect to a Linux server using SSH.
- Perform a DNS lookup.
- Renew a DHCP lease.
- Transfer a file using FTP.
For each activity:
- Identify the protocol(s) involved.
- Apply an appropriate display filter.
- Capture one representative packet.
- Answer the following questions:
- What protocol is being used?
- What purpose does it serve?
- Is the traffic encrypted? Explain your answer.
- Which information can be observed in the packet?
Deliverables
Submit:
- A screenshot of each filtered packet capture.
- The Wireshark display filter used.
- A brief explanation (2–3 sentences) for each protocol.
Homework Assignment 2 – Investigating a Suspicious Network Event
Objective
Use packet analysis techniques to investigate a simulated security incident.
Scenario
You are a junior cybersecurity analyst responding to reports of unusual network activity within Eagle Net. Your supervisor suspects that one system may be communicating using an insecure protocol.
Your task is to collect evidence using Wireshark.
Instructions
-
Generate network traffic using at least three different protocols.
Examples include:
- HTTP
- HTTPS
- FTP
- SSH
- DNS
- ICMP
- Capture all traffic with Wireshark.
- Analyze the capture and identify:
- Source IP address
- Destination IP address
- Transport protocol
- Application protocol
- Whether the communication is encrypted
- Any sensitive information transmitted in clear text
- Recommend one improvement that would make the communication more secure.
Deliverables
Prepare a one-page incident summary containing:
- Description of the observed traffic.
- Attach screenshots to support your findings.
- Evidence of any unencrypted communications.
- Recommended mitigation.
- A conclusion explaining whether the traffic represents normal enterprise activity or a potential security concern.
