Legacy Haven University

Network technicians use protocol analyzers like Wireshark to capture, inspect, and troubleshoot network traffic in real time. This lab demonstrates how to capture packets on a primary network interface, apply display filters to isolate File Transfer Protocol (FTP) traffic, and reconstruct TCP streams to identify unencrypted credentials.

The Mechanics of Packet Capture and Analysis

Protocol analyzers operate by placing a network interface card (NIC) into promiscuous mode—a setting that allows the hardware to intercept and read every network packet that arrives, regardless of the intended destination address. Once captured, the software decodes the raw binary data into human-readable formats based on standard networking protocols.

1. Interface Initialization

To begin capturing traffic, you must bind the analyzer to a specific network interface. In Linux environments, the primary Ethernet interface typically carries the designation eth0. Selecting this interface instructs Wireshark to monitor all inbound and outbound frames traversing that physical connection.

2. Traffic Filtering

Live networks generate massive amounts of background noise, including Address Resolution Protocol (ARP) broadcasts and Domain Name System (DNS) queries. Analysts use display filters to strip away irrelevant data. Applying the ftp filter instructs the software to hide all packets except those utilizing the FTP protocol, isolating the exact conversation needed for analysis.

3. Stream Reconstruction

Individual packets only show fragmented pieces of a conversation. The “Follow TCP Stream” function reads the sequence numbers inside the Transmission Control Protocol (TCP) headers—the tracking numbers that ensure packets arrive in the correct order. Wireshark uses these sequence numbers to reassemble the fragmented payloads into a single, contiguous text block, revealing the exact client-server dialogue.

Lab Walkthrough: Identifying Cleartext Credentials

Execute the following steps to capture traffic and identify unencrypted passwords on the network.

Step 1: Launch Wireshark and Select the Interface

1. Open the Wireshark application.
2. Double-click the eth0 interface from the capture menu. The software immediately begins logging live network traffic.
3. Wait for the capture sequence to conclude.

Step 2: Apply a Display Filter

1. Locate the Display Filter bar at the top of the interface.
2. Type ftp and press Enter. The packet list updates to display only FTP-related frames.

Step 3: Analyze the FTP Handshake

1. Locate the packet containing the USER command (e.g., Packet No. 15).
2. Locate the subsequent packet containing the PASS command (e.g., Packet No. 19).
3. Inspect the Packet Details pane. Because FTP transmits data in cleartext—without cryptographic scrambling—you can read the target password directly in the packet payload.

Step 4: Reconstruct the TCP Stream

1. Right-click any FTP packet in the filtered list.
2. Select Follow TCP Stream.
3. Review the reconstructed output. You will see the entire authentication sequence, including the server banner, the username (anonymous), the password (user@example.com), and the successful login confirmation (230 Login successful).

Security Implications

This lab highlights the critical vulnerability of cleartext protocols. Network administrators must deprecate insecure protocols like FTP, Telnet, and HTTP. Instead, administrators must implement secure, encrypted alternatives such as SFTP (SSH File Transfer Protocol), SSH (Secure Shell), and HTTPS (Hypertext Transfer Protocol Secure) to protect data in transit from eavesdropping attacks.

Authoritative References

CompTIA Network+ N10-009 Certification Objectives (https://www.comptia.org/certifications/network) Wireshark Official Documentation (https://www.wireshark.org/docs/wsug_html_chunked/)