Ayodeji

[Ayodeji @_ayodejiiiii]

My key takeaway for Day 9 is that packets become evidence once they are captured, filtered, and reconstructed into a conversation, and that unencrypted traffic exposes everything it carries.
#Cybersecurity #28DayChallenge

14/14

[Ayodeji @_ayodejiiiii]

Reconstructing conversations is also how analysts investigate incidents, by establishing what was requested, what was returned, and what may have left the network.
#TrafficAnalysis

13/14

[Ayodeji @_ayodejiiiii]

This is the eavesdropping risk from Day 3, and it is why encryption through HTTPS matters.
#NetworkSecurity

12/14

[Ayodeji @_ayodejiiiii]

Everything was readable because HTTP is unencrypted. Anyone able to capture traffic along the path could read the same information, including credentials or cookies if they were sent.

11/14

[Ayodeji @_ayodejiiiii]

The request showed the curl user agent, and the server responded with HTTP/1.1 301 Moved Permanently, redirecting to Google's website, along with its headers and page content.

10/14

[Ayodeji @_ayodejiiiii]

Individual packets only tell part of the story, so Follow TCP Stream was used to reconstruct the full conversation. Wireshark stitched the packets back into one readable exchange of 847 bytes.

9/14

[Ayodeji @_ayodejiiiii]

This ties back to Day 8, where the addresses, ports, and flags sit in the header and the data sits in the payload.

8/14

[Ayodeji @_ayodejiiiii]

Analyzing a packet is done by selecting it and reading its layers in the details pane: frame, Linux cooked capture, Internet Protocol, Transmission Control Protocol, and Hypertext Transfer Protocol, with the raw bytes shown beside them.

7/14

[Ayodeji @_ayodejiiiii]

Applying the display filter "tcp.port == 80" reduced the view to 13 packets of HTTP traffic, which keeps the analysis focused on what is relevant.

6/14

[Ayodeji @_ayodejiiiii]

A raw capture contains a lot of unrelated traffic, so filters are used to narrow it down.

5/14

[Ayodeji @_ayodejiiiii]

Traffic should only be captured on networks that you own or are authorized to monitor, such as a lab environment.

4/14

[Ayodeji @_ayodejiiiii]

Capturing live traffic is concerned with recording packets as they cross a network interface. I started a capture on the "any" interface and generated web traffic with curl, which produced 21 packets.
3/14

[Ayodeji @_ayodejiiiii]

Following the network traffic analysis fundamentals in Day 8, today's learning was centered around the practical side: capturing live traffic, applying filters, analyzing packets, and reconstructing a network conversation using Wireshark.
#Wireshark

2/14

[Ayodeji @_ayodejiiiii]

Day 9 of 28 Learning-In-Public Challenge
Plain HTTP hides nothing. Wireshark showed me every word of the conversation.
#VeenodeLearn #VAF

1/14

[Ayodeji @_ayodejiiiii]

My key takeaway for Day 9 is that packets become evidence once they are captured, filtered, and reconstructed into a conversation, and that unencrypted traffic exposes everything it carries.
#Cybersecurity #28DayChallenge

14/14

[Ayodeji @_ayodejiiiii]

Day 9 of 28 Learning-In-Public Challenge
Plain HTTP hides nothing. Wireshark showed me every word of the conversation.
#VeenodeLearn #VAF

1/14

[Ayodeji @_ayodejiiiii]

Reconstructing conversations is also how analysts investigate incidents, by establishing what was requested, what was returned, and what may have left the network.
#TrafficAnalysis

13/14