Practical Network Packet Analysis – Wireshark

👤 Author

Name: Devansh Jaiswal
Role: Aspiring Cybersecurity Operations Analyst
Email: devanshjaiswal.work@gmail.com

---

📌 Project Overview

This project demonstrates hands-on network security analysis by simulating real-world cyber attacks in a controlled lab environment and analyzing the resulting network traffic using Wireshark.

The objective is to understand:

• How attacks appear at the packet level
• How to detect malicious traffic patterns
• How attackers impact system performance

---

🧪 Lab Environment

Component	Details
Hypervisor	Oracle VirtualBox
Attacker	Kali Linux (192.168.1.12)
Victim	Ubuntu Linux (192.168.1.11)
Network	Isolated Internal Network
Capture Tool	Wireshark

---

🔍 Attacks Simulated

1️⃣ SSH Brute Force Attack

• Tool Used: Hydra
• Target Port: 22 (SSH)
• Detection Indicators:
  • Repeated authentication failures
  • Rapid SSH connection attempts
  • Short time gaps between attempts

---

2️⃣ TCP SYN Flood Attack

• Tool Used: hping3
• Attack Type: Denial of Service (DoS)
• Detection Indicators:
  • Large volume of SYN packets
  • Missing ACK packets
  • Half-open TCP connections

---

3️⃣ ARP Spoofing (Man-in-the-Middle)

• Tool Used: Ettercap
• Detection Indicators:
  • Unsolicited ARP replies
  • Multiple IPs mapped to same MAC
  • Traffic interception (HTTP credentials)

---

4️⃣ ICMP Flood Attack

• Tool Used: hping3
• Detection Indicators:
  • Excessive ICMP Echo Requests
  • High packet rate
  • Increased CPU and network usage

---

🧰 Tools & Technologies

• Wireshark
• Hydra
• hping3
• Ettercap
• Nmap
• Kali Linux
• Ubuntu Linux

---

📊 Key Learnings

• How real attacks look in packet captures
• Effective Wireshark filters for attack detection
• Impact of attacks on system performance
• Importance of traffic analysis in SOC operations

---

📁 Files Included

All the Screenshots of the important Attack Proof.

---

⚠️ Disclaimer

This project was conducted in a fully isolated lab environment for educational purposes only.