terminal TRYHACKME PRACTICAL LEARNING (PRE SECURITY / CYBER 101)

Network Security & Packet Analysis

TCP/IP structures, 3-way handshakes, Wireshark packet capture, display filters, and network inspection.

Overview

Network Security & Packet Analysis forms the core foundation of communication auditing, telemetry analysis, and threat detection. Understanding packet headers, transport handshakes, and protocol behaviors enables practitioners to diagnose communication failures, isolate network anomalies, and identify reconnaissance probes.

Core Concepts

TCP 3-Way Handshake: Connection initiation sequence: Client sends SYN → Server responds with SYN-ACK → Client acknowledges with ACK.
TCP Connection Teardown: Graceful connection termination via FIN flags or abrupt termination via RST flags.
Packet Inspection Layers: Examining protocol structures across Link Layer (Ethernet/MAC), Network Layer (IP/ICMP), Transport Layer (TCP/UDP), and Application Layer (HTTP/DNS).
Capture Filters vs Display Filters: Capture filters (BPF syntax) discard non-matching packets at the NIC driver before saving; display filters evaluate packets in memory within Wireshark.

Tools & Requirements

Wireshark (graphical packet analyzer), tcpdump (command-line packet capture), and netcat.

BASH // PACKET ANALYSIS TOOLINGAPT

$ sudo apt update && sudo apt install -y wireshark tcpdump netcat-traditional

Commands & Practical Examples

1. Capturing Traffic with tcpdump

Capture traffic on interface eth0 without DNS resolution, filtering for HTTP port 80:

BASH // TCPDUMP CAPTUREBPF FILTER

$ sudo tcpdump -i eth0 -nn -c 20 port 80

2. Writing Capture to PCAP File

Record network packets into standard libpcap format for later in-depth analysis in Wireshark:

BASH // PCAP EXPORTRAW PACKETS

$ sudo tcpdump -i any -w capture.pcap -c 1000

3. Essential Wireshark Display Filters

Common filter strings applied during investigation in Wireshark:

WIRESHARK // DISPLAY FILTER SYNTAXFILTER ENGINE

ip.addr == 192.168.1.10
tcp.flags.syn == 1 && tcp.flags.ack == 0
http.request.method == "POST"
dns.flags.response == 1

4. Active Connection Verification with Netcat

Test TCP reachability and grab application banners without full protocol negotiation:

BASH // PORT REACHABILITYNETCAT BANNER

$ nc -zv 192.168.1.10 22 80 443
$ nc -vn 192.168.1.10 80

Practical Workflow

Interface Selection: Identify active physical or virtual interface (ip a).
Capture Baseline: Start capture before triggering network actions to record background traffic.
Execute Activity: Perform specific HTTP request or test probe.
Apply Filters: Filter down by source IP, destination port, or protocol to isolate relevant conversations.
Follow Stream: Use Wireshark's "Follow TCP Stream" to view full payload text in sequence.

Common Mistakes & Troubleshooting

Promiscuous Mode Restrictions: Capturing switched network traffic requires promiscuous mode or port mirroring (SPAN port); otherwise, only broadcast traffic and host-directed packets are received.
Overly Broad Captures: Running unfiltered captures on busy networks fills disk storage rapidly. Always use capture filters (e.g. port 80 or host 10.10.10.5).

Security Considerations & Scoping

Packet capturing intercepts unencrypted application credentials, session tokens, and personal data. Capture traffic exclusively within designated lab networks or with explicit administrative authorization.