Exercise 1: Analyze an HTTP/HTTPS Session rowse a website of your choice using a web browser. Use the filter bar to only show HTTP or HI TPS traffic (e.g. by typing the protocol name into the filter bar). Examine the packets in the captured trame: a Observe the source and destination I addresses, as well as the source and destination b Observe the flIT request and response messages, paying attention to the request

method, URL, status code, content type, and payload.

c Observe the Sob/11s protocol intormation, il present (e.g. certaicate information,

cipher smite. etc.

d Repeat the above steps for different websites or different types of HTTP/HTTPS traffic

(e.g. dynamic vs. static content, different HTTP methods, etc.).

Snift data backets as they are transmitted over hit Drotocol. Loom to a web aDD i-cation that does not use secure communication and capture the plaintext values of all the POST variables submitted to the server via HTTP protoco.

Excercise 2: Analyze TCP and UP traffic

a Start by capturing network traftic.

b Stop the capture in Wireshark and examine the captured traffic.

c You should see a number of packets exchanged between the two machines.

Pay attention to the source and destination IP addresses. source and destination port numbers, and the protocol used (TCP or UDP).

e Analvze the captured traffic to see how the transfer progresses.

f Observe the three-way handshake for TCP connections and the flow of data packets. g You can also look at the different fields in the captured packets, such as sequence numbers, acknowledgment numbers, and flags.

h Finally, repeat the exercise with the other protocol (TOR or UDE and compare the

results to see the dilterences between the two Drotocols

Netstat: Analyzing Network Connections with Netstat

Objectives

To gain hands-on experience in using netstat to monitor network connections and status.

To understand different types of network connections and their properties. To identify and

Task

• Familiarize yourself with the netstat tool, which is available on most operating systems
• Use netstat to monitor network connections and status on your computer. 'Take screen shots of the output to document your findings.
• Analvze the network connections disolaved by netstat and classify them based on the type of connection (e.g. TCP, UDP, or ICMP).

Durbose and runction of the I addresses and Dort numbers.

• Investigate and analyze the security of the network connections by searching for poss-ble malicious activities, such as suspicious I addresses, unusual processes or unusual network behaviors.
• Create a report documenting your findings, including the types of network connections observed. the properties of each connection, and any security issues identitied.

Exercise 1: Analyze network activity using netstat

a Monitor network activity on a specific port and address using netstat. b Identify established and listening TCP connections using netstat.

c Detect open sockets and active connections on a system using netstat.

a Find the PID and process name of the programs that have established a connection

using neusual.

Filter netstat output to show only IP'v4 and IPv6 connections.

f Display the total number of incoming and outgoing

& Detect and diagnose network errors and issues using netstat by analyzing

of the "netstat _s" command

h Monitor network traffic by protocol (TCP, UP, ICMP, etc.) using netstat.

i Compare network statistics over time by periodically running netstat and saving its output to a file.