Highlights

• Captured and analyzed network packets using Wireshark
• TCP handshake discussion with an analogy

The Long Story

In my virtual lab environment, I captured network packets to see how data travels between devices on a network. I am using Wireshark to monitor traffic on my VM running Ubuntu.

The Types of Packets (and Briefly What They Mean)

• DNS (Domain Name System): Converts a readable domain name, like williamgbooth.com and translates it to an IP address that devices on a network can use.
• HTTP (Hypertext Transfer Protocol): Moves assets between servers and clients, like web pages.
• HTTPS (Hypertext Transfer Protocol Secure): Moves assets between servers and clients securely, encrypting the data to protect it from being read by 3rd parties who shouldn’t be able to.
• TCP (Transmission Control Protocol): Uses a “handshake” process to establish reliable connections. Ensures that data is not lost along the way.
• UDP (User Datagram Protocol): Sends data without ensuring a connection first.
• ICMP (Internet Control Message Protocol): Issues error messages in a connectionless manner.
• DHCP (Dynamic Host Configuration Protocol): Assigns local IP addresses, subnet masks, and other details for devices.
• ARP (Address Resolution Protocol): Uses a devices MAC address (hardware address) to match it with an available IP address on the local network.

What’s Going on in Wireshark

Wireshark captures all the network traffic that the network interface on my VM sends and receives. I chose to use a VM for this to safely analyze packets and reduce privacy concerns. The MAC address in Wireshark is not my real hardware MAC address, adding an extra layer of privacy while I study network traffic. I then export the .pcapng file onto my host machine for analysis. I was able to observe all the packets listed above in my captures.

Preliminary Observations

TCP: In this screenshot, the threeway handshake is visible. I have redacted the IP address of the server for privacy reasons (I’m being overkill). My IP address is visible because it is a local address on my VM. The [SYN, SYN-ACK, ACK] sequence on the right of the screenshot shows the steps of the handshake process.

Here are the steps of a TCP handshake:

1. My computer requests a connection to the server by sending a SYN (synchronize) packet.
2. The server responds with a SYN-ACK (synchronize-acknowledge) packet to acknowledge the request.
3. My computer sends an ACK (acknowledge) packet back to the server, completing the handshake and establishing a reliable connection.

It’s kind of like the exchange of rings during a wedding ceremony: one spouse offers a ring (SYN), the other accepts it and offers their own ring in return (SYN-ACK), and finally the first spouse acknowledges the exchange (ACK).

Highlights

• I’m using Minimal Mistakes for my blog
• Packet Scavenger Hunt. Check it out here

The Long Story

This week I worked on my portfolio website! You might be reading this post from it! I build it using Jekyll. I originally building it by hand but realized I took my eye off the ball: my project I set out to do needs to get done! I decided to find a minimal theme to work from. Aptly named, Minimal Mistakes, I needed to get something up and running. There’s time to modify later. Time to work on my project, which brings me to my “Packet Scavenger Hunt”!

This week I captured various types of network traffic in Wireshark. I looked at DNS, TCP, HTTPS, ICMP, DHCP, and ARP traffic to understand how the protocols work and when they appear. Check it out here. My reach goal of making a visually appealing guide for these was out of my reach this week. I hope to swing back to it by the end of the semester but not at the expense of the project as a whole.

This week I’ll be using PyShark to analyze network traffic. I’ll read in the packet capture files (.pcap) and extract key information like timestamps, IP addresses, ports, protocols, lengths. My reach goal for this week is track conversations with a custom dataclass.

No impediments from a project perspective but got in my own way a bit. Read more about it below…

Trying to reinvent the wheel too often is a pattern I run into. I eventually made the wise decision to simplify my website build to refocus on the project itself. The first step is recognizing this pitfall earlier and earlier to cut down on how much it impacts my progress.

Highlights

• Started learning networking foundational knowledge and key concepts using Professor Messer’s CompTIA Network+ prep course lectures on YouTube
• Familiarized myself with Wireshark and planned to work through the Wireshark User’s Guide this week

The Long Story

My project has the dual purpose of preparing me for the CompTIA Network+ exam and building a portfolio project to show prospective employers. I’ll be building a network traffic analyzer. Professor Guinn was awesome and helped outline a ten week plan. I began working networking foundational knowledge and key concepts using Professor Messer’s CompTIA Network+ prep course lectures on YouTube. I’ve chipped away at learning the OSI model, some key port numbers, and IP addressing, just to name a few heavy-hitter topics. I already had Wireshark downloaded but updated to the most current version and poked around, just to familiarize myself with it. I plan on working through the Wireshark User’s Guide this week.

I’m also trying to decide if I work in MacOS or if I use a virtual machine on my mac with Linux. If I were to go the Linux route, which distribution would be best aligned with my goals? From my research I was thinking RHEL or Kali maybe?

The biggest impediment is time management at this point. I am taking a very heavy course load to wrap up my last semester of CSPB, and I’m trying to get my feet under me after the first week. I think I could do a better job of outlining my weekly tasks rather than letting them bounce around in my head and completing them in an ad hoc manner. This week I’ve created a kanban for each of my classes in Obsidian to see what I need to be doing and strategize the approach.

Addendum

I was wisely advised to use Ubuntu as my Linux distribution for this project. This is great, I’m already familiar with that distro and it should provide a solid environment for working with networking tools and Wireshark.

Highlights

• Started drafting project proposal to clarify goals and scope
• Began organizing project tasks and timelines using Trello

The Long Story

This last week has been mostly tying together materials and some initial technologies I will be using for my network packet analysis project.

Because this project is in service of earning my CompTIA Network+ certification, I have purchased the official study materials along with an exam voucher, using a student discount, so I can directly prepare for the exam and also ensure my project will implement hands-on practice and demonstrate knowledge expected by employers. I’ve started on the materials that cover networking fundamentals through written materials, review quizzes, and lab exercises. I won’t work through all of the materials in order at this stage, but will focus on areas pertinent to my project needs. This is in addition to Professor Messer videos that are freely available on YouTube. I also began working through Wireshark documentation: looking at the user interface. I’ll look at capturing this week which brings me to…

I wrote my “draft 0” of my proposal this week! That’s where you just throw down an initial version without worrying too much about it being polished. Writing is hard and rewriting is less hard is my philosophy. This helped me to gain a better grasp of what my project’s aims are and what might be a bit too ambitious. For example, I’d love to build a very customizable dashboard to show off my packet analysis, however I redesigned my approach to prototype a simpler version with the ability to upgrade later if time permits in this class or later on my own accord. I’ve taken a couple passes at my proposal and each time has brought greater clarity to me, and hopefully to the proposal itself, as to where the next few weeks will take me.

I don’t think anything is blocking my path. But I guess one yellow flag is spending so much time setting up a project and resource hunting that it gets in the way of doing it. Or trying to incorporate too many new-to-me technologies.

This past week I was using Google Tasks integrated with Google Calendar to organize this project however I found switching between the two cumbersome and cluttering other parts of my life. I plan on setting up a Trello board to organize tasks, timelines, and other project management related things specifically for this project. It’s another thing to look at (which I don’t love) but I think a clearer, focused perspective is worth it.

Addendum

Highlights

• Started working on the site you see before you
• Captured packets using Wireshark and analyzed HTTP and HTTPS traffic

The Long Story

I’m working on my portfolio/project tracking site. I’m using Jekyll (new to me) so that is taking a little bit of time to get used to. Not terrible but should have smoother sailing ahead now that I have it set up using default layouts.

More directly related to my project…

I captured packets using Wireshark. The first thing I did was look for unencrypted HTTP traffic on port 80. I didn’t see anything malicious, which is always a good start to network monitoring! I did get a quick conversation with an Apple server checking that I have internet access.

I got this:

It doesn’t do anything sensitive so it makes sense to use this port. But the fact that I can see in plain text what was sent is something to be aware of; what if this was the port I was using to log into an account! That’s why it’s critical to make sure that desired traffic is directed to the appropriate ports. Had I wanted anything secure, I’d use Port 443, which is HTTPS (S = Secure). When I checked traffic through Port 443, the application data I received was several bytes that I couldn’t make heads or tails of by just looking at it. Much better for online banking!

I’ve also continued my CompTIA Network+ studies using official materials. It feels good to immediately see the materials applied across in using Wireshark.

Next week I am going to continue working through study materials, working on my website, and go through different types of packets in more depth to understand the differences in DNS, TCP handshakes, HTTPS, ICMP, and DHCP.

I didn’t find the time to create a calendar for this project this past week but will need to do so this week to stay on target.

The biggest risk I am facing is information overload. Not one thing I’m working on this semester is too much, but combined is definitely putting a bit more strain on my ability to learn and retain. Time management has been difficult lately and foreseeably I will still be tight on time. I think the best way to mitigate is to work in smaller chunks with small breaks. I am a big fan of the Pomodoro Method when I write and think I will start using it more for this work. Instead of thinking, “I need to finish x and it’s going to take y,” I’m working on shifting to, “I’m working on x and I will use y/25 min chunks to chip away at it.” It’s more actionable and will get me started earlier.

Addendum

I should have clarified that those port numbers are default ports and the expectation is for traffic to be encrypted if going through 443 but is not guaranteed. In checking packets it can’t be assumed that 443 will be encrypted. HTTPS uses TLS encryption and that’s where the cryptographic magic happens to create session keys from the public and private keys.

Over the next few weeks, I am embarking on a project to learn about computer networking and to prepare for the CompTIA Network+ certification, which I will take in early 2027. As a hands-on way to study for this, I will be making a packet analyzer. Check out my posts to follow my journey!