Class is information Security Fund

Lab 5 Packet Capture and Traffic Analysis. Write answers or provide screen shots to show that you have done the specified work.

Introduction

What is the difference between Wireshark and NetWitness?

Describe the machines in this lab.

Section 1 Part 1

Note: in step 5, the interfaces are the different communication paths you have available to you on this virtual network. You dont want to monitor the traffic on all them, just the ones you are interested in.

Note: You choose the Npcap Loopback Adapter so Wireshark can capture information that the machine would send to itself.

Note: Putty is a terminal access to a Unix/Linux machine while RDP is a remote desktop tool

Note: When connecting with PuTTY to the second switch, go ahead and choose yes when you get a security warning

Step 43. Make a screen capture showing the tftp64: directory (with your transferred file on the targetWidows desktop)

Step 53: Make a screen capture showing the Successful transfers(1) message on the vWorkstation desktop

Note: do not stop after part 1 (by saving your lab state). You will lose the Wireshark data capture you have just created, and it is necessary for analysis later in the lab. If you must save your lab after you stop the capture in part 1, you can do a File->Save As->(navigate to This PC\Desktop)->(give the file an appropriate name)->(hit save). You can then do a File->Open next time you start Wireshark.

Section 1 Part 2

Step 18. Make a screen capture showing the Wireshark frame that displayed the name of the file that was transferred

Section 1 Part 3

Step 11: Make a screen capture of the password information that was captured by Wireshark and has been identified in the analysis by NetWitness