- Analyze traffic patterns using Wireshark
- Predict anomalies indicating potential threats using Python libraries scapy and scikit-learn
- Monitor and analyze network data for ongoing security.
- Familiarity with Kali Linux
- Familiarity with Wireshark is a plus
- Familiarity with Python is a plus
- Kali Linux Virtual Environment
- Wireshark (should already be pre installed in Kali Linux)
- Tshark (should already be pre installed in Kali Linux)
- Python 3 and libraries (numpy, pandas, matplotlib, scikit-learn, scapy)
- In this lab, participants will simulate network traffic analysis using Wireshark within a controlled environment (Kali Linux) to then export as a .pcap file.
- Participants will then simulate predictive anomaly detection using machine learning.
- 30-45 minutes.
- Launch Kali Linux settings on your virtual machine
- Setup Bridged Adaptor Network
- IP Addressing: Run the following command and keep note of the assigned IP.
ifconfig
- Make sure system is updated:
sudo apt update
- Clone Github repository:
git clone https://github.com/faria3islam/WiresharkLab.git
- Change directory into WiresharkLab
cd WiresharkLab
- Install Wireshark, Python, and Dependencies as needed
- To save time, check versions first (ex. wireshark --v or python3 --version)
sudo apt install wireshark -y
sudo apt install tshark -y
sudo apt install python3 python3-pip -y
In this activity, participants will use Wireshark filters to find passwords used on vulnerable sites in a virtual environment. Must be done in virtual environment. Steps:
- Launch Wireshark on Kali Linux
- Choose a network to capture (likely eth0)
- Launch a browser (firefox)
- Using a vulnerable web page, enter login info (link provided: http://testphp.vulnweb.com/login.php)
- Stop capturing packets.
- Filter down the packets to POST and GET packets
- Investigate the packets to find the password used.
- Deliverable: Screenshot of Wireshark capture after filtering and finding password
In this activity, participants get hands-on experience with network security techniques, combining packet capture, data preprocessing, and AI-based anomaly detection. Steps:
- Open a terminal and make sure the instructions in “Lab Setup” were applied.
- Create a virtual environment in python (Recommended)
python -m venv lab_env
source lab_env/bin/activate
pip install -r requirements.txt
- Run preprocess.py to convert the provided .pcap file into csv and process it
python scripts/preprocess.py
- Run analyze_anomalies.py to create anomalies csv and graph
- Graph is expected to display straight line across 0 as packets in sample .pcap file are normal
python scripts/analyze_anomalies.py
- Deliverable: Post a screenshot of the graph generated by analyze_anomalies.py
- Run live_packet_analysis.py to display real time anomaly detection graph
sudo python scripts/live_packet_analysis.py
- CTRL+C to display graph.
- Deliverable: Post a screenshot of the graph generated by live_packet_analysis.py
- How do protocol-based filters (e.g., DNS, HTTP) help narrow down traffic for investigation?
- What additional features (e.g., source/destination IP patterns) would you consider adding for better anomaly detection?
- What are the advantages and limitations of automated anomaly detection compared to manual inspection?
- If unable to create a venv, run the following: -note: alter according to your python version, you can check using python3 --version
sudo apt install python3.12-venv
- If commands using python or python3 don't work as expected, try switching between the two to ensure the command runs successfully
- Module not found error (in our lab, it was sklearn or matplotlib for most of you)
- Try running the following as this could be a virtual environment issue, alter as needed if you're using different paths
sudo /home/kali/WiresharkLab/lab_env/bin/python3 /home/kali/WiresharkLab/scripts/live_packet_analysis.py
- Then, like before, CTRL+C to display graph