Capturing and Analyzing Network Traffic

In Chapter 1, Networking Primer, we covered several networking activities. One that needs to be explored in more depth is the ability to capture and analyze network traffic. Having the skills to capture and analyze packets is crucial during an ethical hack. You may discover sensitive information, such as login credentials, especially when the service being used is insecure. So, let’s dive into sharpening these skills in this chapter.

In this chapter, we are going to cover the following main topics:

• Capturing network traffic
• Working with network traffic in the cloud
• Putting what you have learned into practice
• Best practices

Technical requirements

To complete this chapter, you will require the following:

• Kali Linux 2022.1 or later
• A wireless network adapter capable of working in monitor mode
• Metasploitable 2

In this chapter, we will introduce a new component to our lab: a purposefully vulnerable virtual machine called Metasploitable 2. Although this virtual machine image has been out for a few years, it is still valuable since it enables you to practice your skills.

Metasploitable 2 can be downloaded from the following URL: https://sourceforge.net/projects/metasploitable/files/Metasploitable2/.

Once downloaded, you will need to extract the archive. You can then open the virtual machine with your hypervisor software.

Caution

This virtual machine is vulnerable to a slew of exploits. Please be careful if you expose it to the internet.

Now that we have our lab ready, let’s dive into the chapter.

Capturing network traffic

The technique of capturing network traffic is also known as sniffing. Think of sniffing as listening into a conversation. When you listen in on a conversation between two people, you can learn a lot about either the people themselves or the topic that they are talking about. Likewise, in computing, listening to network traffic can enable you to gain a wealth of information. For instance, think about the types of traffic that traverse a network. These include email, web, and authentication. All of these categories have both unprotected and protected communication options. This means that they can be either encrypted or not encrypted.

When performing packet capturing, you would need to utilize a network sniffer. What a sniffer essentially does is turn a network interface card into a listening device by making it work in promiscuous mode. Promiscuous mode enables the network interface card to listen to and receive all packets that traverse the network, even...

Working with network traffic in the cloud

With cloud services becoming more popular and the increasing move to the cloud by enterprises, maintaining security is crucial. Network Detection and Response (NDR) cloud-centric solutions have surfaced that allow capturing and analyzing network traffic. In the past, performing packet capturing on cloud networks was a challenge, but today, that is not the case. Many cloud providers provide native capabilities for packet mirroring, which allows you to perform packet capturing without the need for additional software. This is all made possible with the use of Virtual Private Cloud (VPC) networks. A VPC is a logical separation of a cloud environment to support private cloud computing. The aim of a VPC is to allow organizations that make use of the cloud to have more granular control over the virtual networks while still reaping the benefits of public cloud resources. Packet mirroring is often configured within VPC networks.

As an ethical hacker...

Putting what you have learned into practice

The best way to practice packet capturing and analysis is to perform it on a range of different protocols. Fortunately, Wireshark has an extensive repository of packet captures that you can download and analyze. The repository can be found at the following link: https://wiki.wireshark.org/SampleCaptures.

Best practices

When it comes to capturing and analyzing network traffic, there are no hard and fast best practices; however, I would like to share some insights that helped me along my career:

• Stick to the basics: When you analyze network traffic, it is imperative that you know how networking works. Many of the network capturing tools today will provide you with great dashboards and insight into the packets. However, you still need to know about the types of network traffic. Think about authentication traffic. If you are targeting RADIUS authentication, you need to know how RADIUS works. The same applies to Active Directory and so forth. Having a good understanding of networking will help you ensure that you are working with the right data packets, and ultimately, it will equip you for success.
• Keep an eye on your capture size: While performing a packet capture on a busy network, the size of your capture file can grow exponentially. At times, you may need to limit the number...

Summary

In this chapter, you have learned how to perform packet captures and analyze a capture. We explored the difference between encrypted traffic and clear text and how these can be seen within a packet capture. Finally, we explored how packet capturing is done within cloud environments and highlighted some best practices to follow when performing packet capturing. In the next chapter, we will dive into a bit of cryptography where you will learn about various encryption algorithms and how they are used today.