Network Traffic Analysis Using Wireshark

Objective

To capture and analyze network traffic using Wireshark in a controlled lab environment in order to understand common network protocols, communication patterns, and basic traffic analysis techniques.

---

Scope

• Environment: Local Lab Environment

• Traffic Analyzed:

  • DNS
  • HTTP
  • TCP
  • ICMP

---

Tools Used

• Wireshark
• Firefox Browser
• Kali Linux

---

Methodology

The assessment followed a structured approach:

1. Network traffic capture
2. Traffic generation through web browsing and ICMP requests
3. Protocol-based traffic filtering
4. Packet inspection and analysis
5. Identification of communication behavior

---

1. Traffic Capture

Purpose: To capture live network traffic from the active network interface.

Output

---

2. DNS Traffic Analysis

Purpose: To analyze Domain Name System (DNS) requests and responses generated during web browsing activity.

Filter Used

dns

Analysis

The DNS traffic revealed domain name resolution requests initiated by the browser before establishing web communication.

Output

---

3. HTTP Traffic Analysis

Purpose: To inspect HTTP communication between the client and web server.

Filter Used

http

Analysis

HTTP traffic showed web requests, responses, and communication headers exchanged between the browser and target web server.

Output

---

4. TCP Traffic Analysis

Purpose: To observe TCP communication and connection establishment between systems.

Filter Used

tcp

Analysis

The TCP packets demonstrated connection establishment processes including SYN, SYN-ACK, and ACK communication patterns.

Output

---

5. ICMP Traffic Analysis

Purpose: To analyze ICMP echo requests and replies generated through ping operations.

Filter Used

icmp

Analysis

ICMP traffic displayed successful communication between systems using echo request and echo reply packets.

Output

---

Findings

• Multiple network protocols were successfully captured and analyzed
• DNS traffic demonstrated domain resolution processes
• HTTP traffic revealed client-server communication behavior
• TCP analysis showed connection establishment mechanisms
• ICMP traffic confirmed successful network reachability testing

---

Risk Analysis

Unmonitored network traffic may expose organizations to:

• Unauthorized communications
• Suspicious outbound connections
• Malware beaconing activity
• Information disclosure risks
• Network reconnaissance activities

---

Mitigation

• Continuously monitor network traffic for anomalies
• Implement intrusion detection and monitoring solutions
• Restrict unnecessary network communications
• Conduct regular traffic analysis and security reviews
• Use secure network configurations and segmentation

---

Conclusion

This lab demonstrates how Wireshark can be used to capture and analyze network traffic for security monitoring and troubleshooting purposes. Understanding network communication patterns is essential for detecting suspicious activity and maintaining network security.

---

Disclaimer

All activities, captures, and analyses demonstrated in this repository were conducted in a controlled lab environment for educational and ethical purposes only. The systems and traffic analyzed were authorized for testing. Unauthorized interception or monitoring of network traffic is illegal and unethical.