{"id":547,"date":"2024-11-27T00:56:02","date_gmt":"2024-11-27T00:56:02","guid":{"rendered":"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/?page_id=547"},"modified":"2024-11-27T00:56:02","modified_gmt":"2024-11-27T00:56:02","slug":"traffic-tracing-and-sniffing","status":"publish","type":"page","link":"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/traffic-tracing-and-sniffing\/","title":{"rendered":"Traffic Tracing and Sniffing"},"content":{"rendered":"\n<h1 class=\"wp-block-heading has-text-align-center\">Old Dominion University<\/h1>\n\n\n\n<h1 class=\"wp-block-heading has-text-align-center\">CYSE 301 Cybersecurity Techniques and Operations<\/h1>\n\n\n\n<h2 class=\"wp-block-heading has-text-align-center\">Assignment 2: Traffic Tracing and Sniffing<\/h2>\n\n\n\n<h2 class=\"wp-block-heading has-text-align-center\">Edwin C Wells IV<\/h2>\n\n\n\n<p><strong>Task A \u2013 Get started with Wireshark<\/strong><\/p>\n\n\n\n<p><strong>Q1<\/strong>. How many packets are captured in total? How many packets are displayed?<\/p>\n\n\n\n<p>36 Packets captured with 36 packets displayed.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-2.png\"><img loading=\"lazy\" decoding=\"async\" width=\"996\" height=\"997\" src=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-2.png\" alt=\"\" class=\"wp-image-548\" srcset=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-2.png 996w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-2-300x300.png 300w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-2-150x150.png 150w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-2-768x769.png 768w\" sizes=\"(max-width: 996px) 100vw, 996px\" \/><\/a><\/figure>\n\n\n\n<p><strong>Q2<\/strong>. Apply \u201cICMP\u201d as a display filter in Wireshark. Then repeat the previous question (Q1).<strong><\/strong><\/p>\n\n\n\n<p>36 Packets were captured with 32\/36 being ICMP protocols.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-3.png\"><img loading=\"lazy\" decoding=\"async\" width=\"996\" height=\"989\" src=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-3.png\" alt=\"\" class=\"wp-image-549\" srcset=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-3.png 996w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-3-300x298.png 300w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-3-150x150.png 150w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-3-768x763.png 768w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-3-302x300.png 302w\" sizes=\"(max-width: 996px) 100vw, 996px\" \/><\/a><\/figure>\n\n\n\n<p><strong>Q3. <\/strong>Select an Echo (reply) message from the list. What are the source and destination IPs of this packet? What are the sequence number and the size of the data? What is the response time?<\/p>\n\n\n\n<p>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Source IP is 192.168.10.10<br>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Destination IP is 192.198.217.3<br>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Sequence number (BE) is 7 and (LE) is 1792<br>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Size is 48 bytes<br>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Response time is 1.984 ms<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-4.png\"><img loading=\"lazy\" decoding=\"async\" width=\"996\" height=\"864\" src=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-4.png\" alt=\"\" class=\"wp-image-550\" srcset=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-4.png 996w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-4-300x260.png 300w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-4-768x666.png 768w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-4-346x300.png 346w\" sizes=\"(max-width: 996px) 100vw, 996px\" \/><\/a><\/figure>\n\n\n\n<p><strong>Q4. <\/strong>Apply \u201cDNS\u201d as a display filter in Wireshark. How many packets are displayed?<\/p>\n\n\n\n<ul>\n<li>There were no DNS packets with previous steps taken thus, began recapturing packets in Wireshark then opened a Firefox window in the virtual machine terminal.\n<ul>\n<li>There are 36 DNS packets displayed out of 72.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-5.png\"><img loading=\"lazy\" decoding=\"async\" width=\"996\" height=\"837\" src=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-5.png\" alt=\"\" class=\"wp-image-551\" srcset=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-5.png 996w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-5-300x252.png 300w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-5-768x645.png 768w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-5-357x300.png 357w\" sizes=\"(max-width: 996px) 100vw, 996px\" \/><\/a><\/figure>\n\n\n\n<p><strong>Q5. <\/strong>Find a DNS query packet. What is the domain name this host is trying to resolve? What is the source IP and port number, destination IP and port number?<\/p>\n\n\n\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong>Host name being resolved is wpad.mshome.net<br>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Source is IP 192.168.217.3 Port 50795<br>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Destination is IP 192.168.217.2 Port 53<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-6.png\"><img loading=\"lazy\" decoding=\"async\" width=\"996\" height=\"836\" src=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-6.png\" alt=\"\" class=\"wp-image-552\" srcset=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-6.png 996w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-6-300x252.png 300w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-6-768x645.png 768w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-6-357x300.png 357w\" sizes=\"(max-width: 996px) 100vw, 996px\" \/><\/a><\/figure>\n\n\n\n<p><strong>Q6. <\/strong>Find the <strong>corresponding <\/strong>DNS response to the query you selected at the previous step, and what is the source IP and port number, destination IP and port number? What is the message replied from the DNS server?<\/p>\n\n\n\n<p>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Source is IP 192.268.217.2 Port 53<br>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Destination is IP 192.168.217.3 Port 50795<br>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Response to standard query is \u201cRefused\u201d.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-8.png\"><img loading=\"lazy\" decoding=\"async\" width=\"996\" height=\"840\" src=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-8.png\" alt=\"\" class=\"wp-image-554\" srcset=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-8.png 996w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-8-300x253.png 300w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-8-768x648.png 768w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-8-356x300.png 356w\" sizes=\"(max-width: 996px) 100vw, 996px\" \/><\/a><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">Task B: Sniff LAN traffic<\/h1>\n\n\n\n<h1 class=\"wp-block-heading\">1.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Sniff ICMP traffic<\/h1>\n\n\n\n<p>Open two terminals on External Kali VM. Use one ping Ubuntu VM and use the other ping Internal Kali.<\/p>\n\n\n\n<ol style=\"list-style-type:lower-alpha\">\n<li>Apply proper display or capture filter on <strong>Internal Kali VM <\/strong>to show active ICMP traffic.\n<ol>\n<li>Captured active ICMP traffic from 192.168.217.3 to 196.168.10.13 and 196.168.10.10<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-9.png\"><img loading=\"lazy\" decoding=\"async\" width=\"996\" height=\"852\" src=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-9.png\" alt=\"\" class=\"wp-image-555\" srcset=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-9.png 996w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-9-300x257.png 300w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-9-768x657.png 768w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-9-351x300.png 351w\" sizes=\"(max-width: 996px) 100vw, 996px\" \/><\/a><\/figure>\n\n\n\n<ul>\n<li>Apply proper display or capture filter on <strong>Internal Kali VM <\/strong>that ONLY displays <strong>ICMP request <\/strong>originated from External Kali VM and goes to Ubuntu 64-bit VM.<ul><li>Used display filter to display only ICMP from 192.168.217.3 to 192.168.10.10 ICMP<\/li><\/ul>\n<ul>\n<li>Command used tshark -I eth0 -Y \u201cicmp &amp;&amp; ip.src==192.168.207.3 &amp;&amp; ip.dst==192.168.10.10\u201d<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-10.png\"><img loading=\"lazy\" decoding=\"async\" width=\"996\" height=\"853\" src=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-10.png\" alt=\"\" class=\"wp-image-556\" srcset=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-10.png 996w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-10-300x257.png 300w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-10-768x658.png 768w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-10-350x300.png 350w\" sizes=\"(max-width: 996px) 100vw, 996px\" \/><\/a><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">2.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Sniff FTP traffic<\/h1>\n\n\n\n<ol style=\"list-style-type:lower-alpha\">\n<li><strong>Ubuntu VM <\/strong>is also serving as an FTP server inside the LAN network. Now, you need to use External Kali to access this FTP server by using the command: <strong>ftp <\/strong><em>[ip_addr of ubuntu VM]<\/em>. The username for the FTP server is <strong>cyse301<\/strong>, and the password is <strong>password<\/strong>. You can follow the steps below to access the FTP server.\n<ol>\n<li><strong>Unfortunately<\/strong>, Internal Kali, the attacker, is also sniffing to the communication. Therefore, all of your communication is exposed to the attacker. Now, you need to find out the <strong>password <\/strong>used by External Kali to access the FTP server from the intercepted traffic on Internal Kali. You need to screenshot and explain how you find the password.<ol><li>I used the command line tshark -I 1 -Y \u201cftp\u201d to display the FTP packets between 192.168.217.3 and 192.168.10.10<\/li><\/ol><ol><li>Packet 214 contains the user ID<\/li><\/ol><ol><li>Packet 266 contains the password input from 192.168.217.3<\/li><\/ol><ol><li>Packet 267 contains the login successful verification.<\/li><\/ol>\n<ol>\n<li>Thus we have a verified user ID and password<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-11.png\"><img loading=\"lazy\" decoding=\"async\" width=\"996\" height=\"837\" src=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-11.png\" alt=\"\" class=\"wp-image-557\" srcset=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-11.png 996w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-11-300x252.png 300w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-11-768x645.png 768w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-11-357x300.png 357w\" sizes=\"(max-width: 996px) 100vw, 996px\" \/><\/a><\/figure>\n\n\n\n<ul>\n<li>After you successfully find the username &amp; password from the FTP traffic, repeat the previous step (2.a), and use your <strong>MIDAS ID <\/strong>as the username and <strong>UIN <\/strong>as the password to reaccess the FTP server from External Kali. Although External Kali may not access the FTP server, you need to intercept the packets containing these \u201csecrets\u201d from the attacker VM, which is <strong>Internal Kali<\/strong>.<ul><li>I used the command line tshark -I 1 -Y \u201cftp\u201d to display the FTP packets between 192.168.217.3 and 192.168.10.10<\/li><\/ul><ul><li>Attempted to log into the FTP server with my MIDAS information on the external Kali machine.<\/li><\/ul><ul><li>Packet 202 contains the USER ID request<\/li><\/ul><ul><li>Packet 394 contains the password input<\/li><\/ul>\n<ul>\n<li>Packet 478 responds with an incorrect login<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-12.png\"><img loading=\"lazy\" decoding=\"async\" width=\"996\" height=\"839\" src=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-12.png\" alt=\"\" class=\"wp-image-558\" srcset=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-12.png 996w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-12-300x253.png 300w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-12-768x647.png 768w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-12-356x300.png 356w\" sizes=\"(max-width: 996px) 100vw, 996px\" \/><\/a><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">Task C \u2013 Extra credit: Steal files with Wireshark<\/h1>\n\n\n\n<p>Login to Ubuntu VM, and create a file in your home directory, named \u201cYOUR_MIDAS.txt\u201d. Put the current timestamp and your name in the file.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-14.png\"><img loading=\"lazy\" decoding=\"async\" width=\"996\" height=\"841\" src=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-14.png\" alt=\"\" class=\"wp-image-560\" srcset=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-14.png 996w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-14-300x253.png 300w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-14-768x648.png 768w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-14-355x300.png 355w\" sizes=\"(max-width: 996px) 100vw, 996px\" \/><\/a><\/figure>\n\n\n\n<p>Once you have the file ready in Ubuntu, switch back to <strong>External Kali<\/strong>. Get the file you just created with FTP protocol remotely.<\/p>\n\n\n\n<ul>\n<li>Logged into ftp server from external kali<\/li>\n\n\n\n<li>Used the get command to retrieve ewell007.txt<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-15.png\"><img loading=\"lazy\" decoding=\"async\" width=\"996\" height=\"839\" src=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-15.png\" alt=\"\" class=\"wp-image-561\" srcset=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-15.png 996w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-15-300x253.png 300w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-15-768x647.png 768w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-15-356x300.png 356w\" sizes=\"(max-width: 996px) 100vw, 996px\" \/><\/a><\/figure>\n\n\n\n<ol>\n<li>Apply a proper display filter to display the <strong>FTP-DATA <\/strong>packets between External Kali and Ubuntu VM.<ol><li>Switched to the internal kali machine<\/li><\/ol>\n<ol>\n<li>Used ftp-data to filter display to 1 packet out of 1109 packets<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-16.png\"><img loading=\"lazy\" decoding=\"async\" width=\"996\" height=\"836\" src=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-16.png\" alt=\"\" class=\"wp-image-562\" srcset=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-16.png 996w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-16-300x252.png 300w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-16-768x645.png 768w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-16-357x300.png 357w\" sizes=\"(max-width: 996px) 100vw, 996px\" \/><\/a><\/figure>\n\n\n\n<ul>\n<li>Follow the tcp steam of the <strong>FTP-DATA <\/strong>packet, and view the content of the file just transferred.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-17.png\"><img loading=\"lazy\" decoding=\"async\" width=\"996\" height=\"839\" src=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-17.png\" alt=\"\" class=\"wp-image-563\" srcset=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-17.png 996w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-17-300x253.png 300w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-17-768x647.png 768w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-17-356x300.png 356w\" sizes=\"(max-width: 996px) 100vw, 996px\" \/><\/a><\/figure>\n\n\n\n<ul>\n<li>Export (Save) the transferred file as a text file in Internal Kali and view the content.<ul><li>Saved the TCP stream a text file \u201ctransferred ewell007\u201d on the kali internal machine desktop<\/li><\/ul>\n<ul>\n<li>Viewed the file<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-18.png\"><img loading=\"lazy\" decoding=\"async\" width=\"996\" height=\"838\" src=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-18.png\" alt=\"\" class=\"wp-image-564\" srcset=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-18.png 996w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-18-300x252.png 300w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-18-768x646.png 768w, https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-content\/uploads\/sites\/30994\/2024\/11\/image-18-357x300.png 357w\" sizes=\"(max-width: 996px) 100vw, 996px\" \/><\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Old Dominion University CYSE 301 Cybersecurity Techniques and Operations Assignment 2: Traffic Tracing and Sniffing Edwin C Wells IV Task A \u2013 Get started with Wireshark Q1. How many packets are captured in total? How many packets are displayed? 36 Packets captured with 36 packets displayed. Q2. Apply \u201cICMP\u201d as a display filter in Wireshark&#8230;. <\/p>\n<div class=\"link-more\"><a href=\"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/traffic-tracing-and-sniffing\/\">Read More<\/a><\/div>\n","protected":false},"author":25223,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"_links":{"self":[{"href":"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-json\/wp\/v2\/pages\/547"}],"collection":[{"href":"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-json\/wp\/v2\/users\/25223"}],"replies":[{"embeddable":true,"href":"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-json\/wp\/v2\/comments?post=547"}],"version-history":[{"count":1,"href":"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-json\/wp\/v2\/pages\/547\/revisions"}],"predecessor-version":[{"id":565,"href":"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-json\/wp\/v2\/pages\/547\/revisions\/565"}],"wp:attachment":[{"href":"https:\/\/sites.wp.odu.edu\/edwin-wells-4\/wp-json\/wp\/v2\/media?parent=547"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}