Network traffic analysis in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to capture network packets using a common tool.

Cybersecurity

tcpdump -i [1]

Drag options to blanks, or click blank then click option'

A192.168.1.1

Bfile.txt

Ceth0

Dport 80

Attempts:

3 left

💡 Hint

Common Mistakes

Using a filename instead of an interface.

Using an IP address where interface name is required.

The tcpdump command uses -i to specify the network interface, such as eth0.

2fill in blank

medium

Complete the command to filter captured traffic by HTTP port.

Cybersecurity

tcpdump port [1]

Drag options to blanks, or click blank then click option'

A53

B22

C443

D80

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing port 22 which is for SSH.

Choosing port 443 which is for HTTPS.

HTTP traffic commonly uses port 80.

3fill in blank

hard

Fix the error in the command to save captured packets to a file.

Cybersecurity

tcpdump -w [1]

Drag options to blanks, or click blank then click option'

Acapture.pcap

Bcapture.txt

Ccapture.log

Dcapture.csv

Attempts:

3 left

💡 Hint

Common Mistakes

Using .txt or .log which are not valid capture formats.

Using .csv which is not suitable for packet data.

The -w option saves packets in pcap format, so the file should have a .pcap extension.

4fill in blank

hard

Fill both blanks to create a filter for TCP traffic from a specific IP.

Cybersecurity

tcpdump tcp and src [1] and dst port [2]

Drag options to blanks, or click blank then click option'

A192.168.0.10

B22

C80

Dudp

Attempts:

3 left

💡 Hint

Common Mistakes

Using UDP instead of TCP in the filter.

Mixing source IP and port numbers incorrectly.

This command filters TCP packets from source IP 192.168.0.10 to destination port 80, which is common for HTTP.

5fill in blank

hard

Fill all three blanks to create a dictionary comprehension that maps IPs to packet sizes for packets larger than 100 bytes.

Cybersecurity

packet_counts = [1]: [2] for [3] in packets if len([3].data) > 100

Drag options to blanks, or click blank then click option'

Apkt.src_ip

Bpkt.size

Cpkt

Dpkt.dest_ip

Attempts:

3 left

💡 Hint

Common Mistakes

Using destination IP instead of source IP as key.

Using wrong variable names causing errors.

This comprehension creates a dictionary where keys are source IPs (pkt.src_ip) and values are packet sizes (pkt.size) for packets larger than 100 bytes, iterating over each packet as pkt.

Practice

1. What is the main purpose of network traffic analysis?

easy

A. To create new network devices

B. To monitor and understand data flow in a network

C. To increase the physical size of a network

D. To replace all network cables

Solution

1. Step 1: Understand the role of network traffic analysis

   Network traffic analysis involves watching data packets moving through a network to understand how the network is used.

2. Step 2: Identify the main goal

   The main goal is to monitor and understand data flow to keep the network safe and efficient.

3. Final Answer:

   To monitor and understand data flow in a network -> Option B

4. Quick Check:

   Network traffic analysis = monitor data flow [OK]

Hint: Think about what watching data packets achieves [OK]

Common Mistakes:

• Confusing analysis with physical network building
• Thinking it creates devices
• Assuming it changes network size

2. Which of the following is a common tool used in network traffic analysis?

easy

A. Wireshark

B. Photoshop

C. Excel

D. WordPress

Solution

1. Step 1: Identify tools related to network traffic

   Wireshark is a well-known tool designed to capture and analyze network packets.

2. Step 2: Eliminate unrelated tools

   Photoshop is for images, Excel for spreadsheets, and WordPress for websites, none analyze network traffic.

3. Final Answer:

   Wireshark -> Option A

4. Quick Check:

   Network analysis tool = Wireshark [OK]

Hint: Pick the tool known for packet capture [OK]

Common Mistakes:

• Choosing software unrelated to networks
• Confusing general software with analysis tools
• Not recognizing Wireshark

3. Consider this simplified network traffic log snippet:
Time: 10:00, Source IP: 192.168.1.5, Destination IP: 10.0.0.2, Protocol: TCP, Size: 1500 bytes
What does this entry tell you?

medium

A. A TCP packet of 1500 bytes was sent from 192.168.1.5 to 10.0.0.2 at 10:00

B. A UDP packet of 1500 bytes was sent from 10.0.0.2 to 192.168.1.5 at 10:00

C. A TCP packet of 1500 bytes was sent from 10.0.0.2 to 192.168.1.5 at 10:00

D. A TCP packet of 1500 bytes was sent from 192.168.1.5 to 10.0.0.2 at 11:00

Solution

1. Step 1: Read the log details carefully

   The log shows a packet sent at 10:00 from source IP 192.168.1.5 to destination IP 10.0.0.2 using TCP protocol with size 1500 bytes.

2. Step 2: Match details with options

   A TCP packet of 1500 bytes was sent from 192.168.1.5 to 10.0.0.2 at 10:00 matches all details exactly. Other options have wrong protocol, IP direction, or time.

3. Final Answer:

   A TCP packet of 1500 bytes was sent from 192.168.1.5 to 10.0.0.2 at 10:00 -> Option A

4. Quick Check:

   Match log details exactly = A TCP packet of 1500 bytes was sent from 192.168.1.5 to 10.0.0.2 at 10:00 [OK]

Hint: Match source, destination, protocol, and time exactly [OK]

Common Mistakes:

• Mixing up source and destination IPs
• Confusing TCP with UDP
• Misreading the timestamp

4. A network analyst wrote this filter to capture only HTTP traffic:
tcp.port == 80
But it captures no packets. What is the likely error?

medium

A. The filter should be 'tcp.port != 80'

B. The filter should be 'udp.port == 80' instead

C. The filter should be 'tcp.port = 80' with one equal sign

D. The filter should use 'tcp.dstport == 80' or 'tcp.srcport == 80' instead

Solution

1. Step 1: Understand the filter syntax

   In many network tools, 'tcp.port' alone is not a valid filter; you must specify source or destination port.

2. Step 2: Identify correct filter usage

   Using 'tcp.dstport == 80' or 'tcp.srcport == 80' correctly filters HTTP traffic on port 80.

3. Final Answer:

   The filter should use 'tcp.dstport == 80' or 'tcp.srcport == 80' instead -> Option D

4. Quick Check:

   Specify source or destination port for correct filtering [OK]

Hint: Specify src or dst port, not just tcp.port [OK]

Common Mistakes:

• Using single '=' instead of '=='
• Filtering UDP instead of TCP
• Using '!=' which excludes port 80

5. You want to detect unusual spikes in network traffic size over time. Which approach best applies network traffic analysis?

hard

A. Ignore packet sizes and focus on IP addresses only

B. Only capture packets during business hours

C. Capture packets continuously and analyze size trends using graphs

D. Manually check each packet without tools

Solution

1. Step 1: Understand the goal of detecting traffic spikes

   Detecting spikes means watching how packet sizes change over time, requiring continuous data collection.

2. Step 2: Identify the best method

   Using tools to capture packets continuously and graph size trends helps spot unusual spikes effectively.

3. Final Answer:

   Capture packets continuously and analyze size trends using graphs -> Option C

4. Quick Check:

   Continuous capture + trend analysis = detect spikes [OK]

Hint: Use continuous capture and graph size changes [OK]

Common Mistakes:

• Limiting capture times reduces data accuracy
• Ignoring packet size misses spike info
• Manual checking is impractical for large data