{
    "id": "906b33d1-5647-4898-bc9c-7a2cade72bd4",
    "name": "Traffic Analysis Using Wireshark - Part 2",
    "slug": "traffic-analysis-using-wireshark-part-2",
    "status": "published",
    "lab_type": "pta",
    "is_sample": false,
    "duration_in_seconds": 1800,
    "metadata": {
        "courses": [
            "cd60ce4a-1b83-48c4-8d38-7e6bfeab4a1e"
        ],
        "pta_sdn": "58",
        "pta_namespace": "my.ine",
        "learning_paths": [],
        "has_published_parent": true
    },
    "session": null,
    "company": "a491bc32-c056-4946-9169-cc053387bada",
    "created": "2022-03-30T03:04:48.786285Z",
    "modified": "2024-04-30T14:35:42.749459Z",
    "is_beta": false,
    "lab_objectives": [],
    "main_learning_area": "3e1aa06f-2e9f-4789-b50d-aa027ad8dcfa",
    "learning_areas": [
        {
            "id": "3e1aa06f-2e9f-4789-b50d-aa027ad8dcfa",
            "name": "Cyber Security",
            "slug": "cyber-security"
        }
    ],
    "categories": [],
    "tags": [],
    "difficulty": null,
    "is_web_access": false,
    "is_lab_experience": false,
    "is_featured": false,
    "cve": null,
    "severity": null,
    "year": null,
    "classification": null,
    "external_url": "",
    "solution_video": null,
    "explanation_video": null,
    "description": "# Scenario\n\nYou are presented with captured traffic from an internal network. Your job is to identify the various users and applications that were working in that network.\n\n# Goals\n\n-   Identify the network's users\n-   Identify protocols working within a network.\n\n# What you will learn\n\n-   How to use Wireshark to identify network activities.\n-   How to examine the headers and the payloads.\n-   Identifying and spotting different activities on the network.\n\n# Recommended tools\n\n-   **Wireshark**",
    "description_html": "<h1>Scenario</h1>\n<p>You are presented with captured traffic from an internal network. Your job is to identify the various users and applications that were working in that network.</p>\n<h1>Goals</h1>\n<ul>\n<li>Identify the network's users</li>\n<li>Identify protocols working within a network.</li>\n</ul>\n<h1>What you will learn</h1>\n<ul>\n<li>How to use Wireshark to identify network activities.</li>\n<li>How to examine the headers and the payloads.</li>\n<li>Identifying and spotting different activities on the network.</li>\n</ul>\n<h1>Recommended tools</h1>\n<ul>\n<li><strong>Wireshark</strong></li>\n</ul>",
    "tasks": "# Tasks\n\n## Task 1: Perform Protocol Statistics\n\nThe provided PCAP file can be found at **Desktop/Module7/Lab19/Network_analysis_lab_Full.pcapng.**\n\nTo which protocols do the captured packets belong to? What is the most used application layer protocol?\n\n## Task 2: Identify the Number of Users and Study their Traffic Habits\n\nHow many users can you identify, inside this PCAP file? What can you tell about them, by analyzing their generated traffic?\n\n## Task 3: Analyze and Describe the Users' Web Activities \n\nExplore the different Wireshark functionalities to extract HTTP-related information.\n\n## Task 4: Analyze and Describe the User's Mailing Activities\n\nApply the appropriate filter to focus on IMAP and SMTP traffic.",
    "tasks_html": "<h1>Tasks</h1>\n<h2>Task 1: Perform Protocol Statistics</h2>\n<p>The provided PCAP file can be found at <strong>Desktop/Module7/Lab19/Network_analysis_lab_Full.pcapng.</strong></p>\n<p>To which protocols do the captured packets belong to? What is the most used application layer protocol?</p>\n<h2>Task 2: Identify the Number of Users and Study their Traffic Habits</h2>\n<p>How many users can you identify, inside this PCAP file? What can you tell about them, by analyzing their generated traffic?</p>\n<h2>Task 3: Analyze and Describe the Users' Web Activities</h2>\n<p>Explore the different Wireshark functionalities to extract HTTP-related information.</p>\n<h2>Task 4: Analyze and Describe the User's Mailing Activities</h2>\n<p>Apply the appropriate filter to focus on IMAP and SMTP traffic.</p>",
    "published_date": "2020-10-20T15:32:26Z",
    "solutions": "# Solutions \n\n## Task 1: Perform Protocol Statistics\n\nThe provided PCAP file can be found at **Desktop/Module7/Lab19/Network_analysis_lab_Full.pcapng**\n\nFirst, load this PCAP file into Wireshark.\n\nWireshark has a built-in statistical tool which allows us to get a general overview of the protocols which the captured packets belong to.\n\nThis is accessible from **Statistics -> Protocol Hierarchy**\n\n![1](https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/1.png)\n\n![2](https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/2.png)\n\nWe can see that the frames we captured can be categorized into three groups; IPV4, IPV6, and ARP frames.\n\nWe can see in the second column (percent packets) that IPV4 packets make more than 95% of the captured packets.\n\n![3](https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/3.png)\n\nTCP constitutes 95% of the IPV4 packets while UDP 5% and the rest is between **ICMP** and **IGMP** protocols.\n\n![4](https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/4.png)\n\nLet's start with UDP since it should be easier. Within the UDP section, we can notice few known application layer protocols. Namely **DNS** and **Bootstrap** (DHCP).\n\nWe can also find less known protocols such as **NetBIOS** (for name registration) and **SSDP** (HTTP based protocol for network service discovery).\n\n![5](https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/5.png)\n\nIn the TCP section, we have **SMTP** and **IMAP** (which suggests their mail exchange activities). **HTTP** and **SSL** tell us that there is web browsing activity.\n\nWe can examine few statistics about the HTTP traffic within the file.\n\nThis tells us what type of files were exchanged over HTTP.\n\n![6](https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/6.png)\n\n## Task 2: Identify the Number of Users and Study their Traffic Habits\n\nOne way we can count how many users are within the network is by sorting the packets we have based on the IP address and picking the private IPv4 addresses. Sorting the addresses will make it easy for us to identify different addresses.\n\nAlternatively, we can use the statistical feature again in Wireshark to extract all the addresses within the capture file.\n\n![7](https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/7.png)\n\n![8](https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/8.png)\n\nAfter sorting the IP addresses, we can look for the IPV4 private range which, in small networks, usually starts with **192.168.**\n\nThe IP that ends with 255 is called the **broadcast** address, which is used when a device wants to send something to the whole network.\n\nSometimes, packets can tell us a lot about the operating systems they came from.\n\nFields such as \"**TTL,\"** for example, may be used to identify the machine's OS.\n\nOn most modern Windows machines, the default **Time-to-Live** is 128, while the default value for most Linux distributions is 64. Cisco IOS, on the other hand, uses the value 254 as the default TTL.\n\nOn a higher layer, HTTP headers, specifically, the **user-agent** may also be used to identify the user's OS.\n\nIn our example, we can look for HTTP traffic that originated from one of the private IPv4 addresses we found earlier using Wireshark filter.\n\n```\nhttp and ip.src==192.168.153.137\n```\n\n![9](https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/9.png)\n\nLooking at the user-agent header, we now know that the machine **192.168.153.137** is Windows NT 6.1 (Windows 7) machine.\n\n## Task 3: Analyze and Describe the Users' Web Activities \n\nIf we want to analyze the user's web activities, we need to find a way to know what websites the users have requested.\n\nThe not-very-smart way to do this would be to filter the traffic we have and examine the HTTP traffic only. Using the filter `http`. After that, we can follow the HTTP streams for the packets we have.\n\n![10](https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/10.png)\n\nThis is a slightly smarter way is to filter the DNS requests that were made by the users. Since HTTP requests usually get preceded by DNS query asking about the IP of the destination domain, examining the DNS queries that are requesting records of Type A could help know what domains were accessed by the users. Using filter `dns.a`.\n\n![11](https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/11.png)\n\nThe other way to do this is to look for the HTTP statistics so we can tell which domains were accessed by the users.\n\n![12](https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/12.png)\n\nThe display window will show us the domains and sub-domains requested by the users.\n\n![13](https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/13.png)\n\nWe can click on any displayed domain to get the exact URL that was requested by the user. For example, we can notice that the user has downloaded a file from the BBC website.\n\n![14](https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/14.png)\n\nWe'll get on how to extract that file later.\n\n# Task 4: Analyze and Describe the User's Mailing Activities\n\nAs discussed earlier, there are two protocols for working with emails; **SMTP** and **IMAP**. The latter is used to access to mailbox and view email, while the first is used to send emails. We'll examine the login process first using the ```imap``` filter in Wireshark and view the TCP stream option.\n\n![15](https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/15.png)\n\nThe connection starts with the server displaying its time.\n\nThe client requests the server capabilities which the server replies to by sending a list of possible operations.\n\nThe client requests a challenge-response md5 based authentication.\n\nChallenge response protocol differs from password-based authentication protocol in that the first doesn't send the password itself instead of the server since a challenge to the client cannot be solved unless the client has the right password.\n\nThe server sends the challenge in base 64 encoding, and the client sends their response for the challenge using the same encoding scheme.\n\nSince the user supplied the right password, the server replies with an okay message telling the user that the authentication has been successful.\n\nLater that client requests to view his mailbox including the inbox, junk box, trash, etc.\n\n![16](https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/16.png)\n\nUsing the same methodology, we can filter for SMTP protocol tickets to see the emails that were sent during the capture. We need to replace the imap filter with an SMTP filter and view the TCP stream.\n\n![17](https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/17.png)\n\nThe session also starts with the server sending its banner and its time to the client.\n\nThe client replies for the better with the extended hello command.\n\nThe server offers different operations for the client to choose from.\n\nAs we saw earlier the client authenticate using its username and password and then it sends an email to user2 asking them to delay an appointment",
    "solutions_html": "<h1>Solutions</h1>\n<h2>Task 1: Perform Protocol Statistics</h2>\n<p>The provided PCAP file can be found at <strong>Desktop/Module7/Lab19/Network_analysis_lab_Full.pcapng</strong></p>\n<p>First, load this PCAP file into Wireshark.</p>\n<p>Wireshark has a built-in statistical tool which allows us to get a general overview of the protocols which the captured packets belong to.</p>\n<p>This is accessible from <strong>Statistics -&gt; Protocol Hierarchy</strong></p>\n<p><img alt=\"1\" src=\"https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/1.png\" /></p>\n<p><img alt=\"2\" src=\"https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/2.png\" /></p>\n<p>We can see that the frames we captured can be categorized into three groups; IPV4, IPV6, and ARP frames.</p>\n<p>We can see in the second column (percent packets) that IPV4 packets make more than 95% of the captured packets.</p>\n<p><img alt=\"3\" src=\"https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/3.png\" /></p>\n<p>TCP constitutes 95% of the IPV4 packets while UDP 5% and the rest is between <strong>ICMP</strong> and <strong>IGMP</strong> protocols.</p>\n<p><img alt=\"4\" src=\"https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/4.png\" /></p>\n<p>Let's start with UDP since it should be easier. Within the UDP section, we can notice few known application layer protocols. Namely <strong>DNS</strong> and <strong>Bootstrap</strong> (DHCP).</p>\n<p>We can also find less known protocols such as <strong>NetBIOS</strong> (for name registration) and <strong>SSDP</strong> (HTTP based protocol for network service discovery).</p>\n<p><img alt=\"5\" src=\"https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/5.png\" /></p>\n<p>In the TCP section, we have <strong>SMTP</strong> and <strong>IMAP</strong> (which suggests their mail exchange activities). <strong>HTTP</strong> and <strong>SSL</strong> tell us that there is web browsing activity.</p>\n<p>We can examine few statistics about the HTTP traffic within the file.</p>\n<p>This tells us what type of files were exchanged over HTTP.</p>\n<p><img alt=\"6\" src=\"https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/6.png\" /></p>\n<h2>Task 2: Identify the Number of Users and Study their Traffic Habits</h2>\n<p>One way we can count how many users are within the network is by sorting the packets we have based on the IP address and picking the private IPv4 addresses. Sorting the addresses will make it easy for us to identify different addresses.</p>\n<p>Alternatively, we can use the statistical feature again in Wireshark to extract all the addresses within the capture file.</p>\n<p><img alt=\"7\" src=\"https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/7.png\" /></p>\n<p><img alt=\"8\" src=\"https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/8.png\" /></p>\n<p>After sorting the IP addresses, we can look for the IPV4 private range which, in small networks, usually starts with <strong>192.168.</strong></p>\n<p>The IP that ends with 255 is called the <strong>broadcast</strong> address, which is used when a device wants to send something to the whole network.</p>\n<p>Sometimes, packets can tell us a lot about the operating systems they came from.</p>\n<p>Fields such as \"<strong>TTL,\"</strong> for example, may be used to identify the machine's OS.</p>\n<p>On most modern Windows machines, the default <strong>Time-to-Live</strong> is 128, while the default value for most Linux distributions is 64. Cisco IOS, on the other hand, uses the value 254 as the default TTL.</p>\n<p>On a higher layer, HTTP headers, specifically, the <strong>user-agent</strong> may also be used to identify the user's OS.</p>\n<p>In our example, we can look for HTTP traffic that originated from one of the private IPv4 addresses we found earlier using Wireshark filter.</p>\n<pre class=\"codehilite\"><code>http and ip.src==192.168.153.137</code></pre>\n\n<p><img alt=\"9\" src=\"https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/9.png\" /></p>\n<p>Looking at the user-agent header, we now know that the machine <strong>192.168.153.137</strong> is Windows NT 6.1 (Windows 7) machine.</p>\n<h2>Task 3: Analyze and Describe the Users' Web Activities</h2>\n<p>If we want to analyze the user's web activities, we need to find a way to know what websites the users have requested.</p>\n<p>The not-very-smart way to do this would be to filter the traffic we have and examine the HTTP traffic only. Using the filter <code>http</code>. After that, we can follow the HTTP streams for the packets we have.</p>\n<p><img alt=\"10\" src=\"https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/10.png\" /></p>\n<p>This is a slightly smarter way is to filter the DNS requests that were made by the users. Since HTTP requests usually get preceded by DNS query asking about the IP of the destination domain, examining the DNS queries that are requesting records of Type A could help know what domains were accessed by the users. Using filter <code>dns.a</code>.</p>\n<p><img alt=\"11\" src=\"https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/11.png\" /></p>\n<p>The other way to do this is to look for the HTTP statistics so we can tell which domains were accessed by the users.</p>\n<p><img alt=\"12\" src=\"https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/12.png\" /></p>\n<p>The display window will show us the domains and sub-domains requested by the users.</p>\n<p><img alt=\"13\" src=\"https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/13.png\" /></p>\n<p>We can click on any displayed domain to get the exact URL that was requested by the user. For example, we can notice that the user has downloaded a file from the BBC website.</p>\n<p><img alt=\"14\" src=\"https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/14.png\" /></p>\n<p>We'll get on how to extract that file later.</p>\n<h1>Task 4: Analyze and Describe the User's Mailing Activities</h1>\n<p>As discussed earlier, there are two protocols for working with emails; <strong>SMTP</strong> and <strong>IMAP</strong>. The latter is used to access to mailbox and view email, while the first is used to send emails. We'll examine the login process first using the <code>imap</code> filter in Wireshark and view the TCP stream option.</p>\n<p><img alt=\"15\" src=\"https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/15.png\" /></p>\n<p>The connection starts with the server displaying its time.</p>\n<p>The client requests the server capabilities which the server replies to by sending a list of possible operations.</p>\n<p>The client requests a challenge-response md5 based authentication.</p>\n<p>Challenge response protocol differs from password-based authentication protocol in that the first doesn't send the password itself instead of the server since a challenge to the client cannot be solved unless the client has the right password.</p>\n<p>The server sends the challenge in base 64 encoding, and the client sends their response for the challenge using the same encoding scheme.</p>\n<p>Since the user supplied the right password, the server replies with an okay message telling the user that the authentication has been successful.</p>\n<p>Later that client requests to view his mailbox including the inbox, junk box, trash, etc.</p>\n<p><img alt=\"16\" src=\"https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/16.png\" /></p>\n<p>Using the same methodology, we can filter for SMTP protocol tickets to see the emails that were sent during the capture. We need to replace the imap filter with an SMTP filter and view the TCP stream.</p>\n<p><img alt=\"17\" src=\"https://assets.ine.com/content/ptp/lab_19_traffic_analysis_using_wireshark_part_2/17.png\" /></p>\n<p>The session also starts with the server sending its banner and its time to the client.</p>\n<p>The client replies for the better with the extended hello command.</p>\n<p>The server offers different operations for the client to choose from.</p>\n<p>As we saw earlier the client authenticate using its username and password and then it sends an email to user2 asking them to delay an appointment</p>",
    "flags": [],
    "min_points_to_pass": null,
    "access_type": "default",
    "user_status": "unstarted",
    "user_lab_status": null,
    "user_status_modified": null,
    "user_flags": [],
    "global_running_session": null
}