Capture what a host volunteers before you authenticate

short · 50 min · Objective 2.1

Task

Capture traffic on your own lab segment and find how much an environment describes itself before any credential is involved — the broadcast chatter, service announcements and cleartext that make a switched network readable to anyone on it.

Steps

  1. On the lab network you own, start a capture on the Linux VM while the other VMs do ordinary things — resolve names, browse an internal service, mount a share.
  2. Let it run fifteen minutes, then stop and save the capture to /tmp/recon.pcap.
  3. Extract every distinct source address seen, and every protocol present.
  4. Find the announcements: name-resolution fallbacks that broadcast to the segment, service-discovery chatter, and any banners that state software and version on connection.
  5. Find any cleartext credential or session identifier in your own capture — stand up a service that authenticates in the clear if you need one — and note how little work it took.
  6. Write a short activity log: what you ran, when, and against which lab hosts.

Verify

tshark -r /tmp/recon.pcap -T fields -e ip.src 2>/dev/null | sort -u | wc -l
tshark -r /tmp/recon.pcap -q -z io,phs 2>/dev/null | grep -ciE "arp|dns|nbns|mdns|llmnr|http"
tshark -r /tmp/recon.pcap -Y "http.authorization || ftp.request.command == USER" 2>/dev/null | wc -l

The first count must be at least the number of VMs generating traffic. The second must be non-zero: a real capture of an active segment always shows some of these announcing protocols. The third counts cleartext authentication attempts — non-zero if you stood up a cleartext service, and the number to remember when a client asks whether "it's internal" is a reason not to encrypt.

Notes

The moment you capture, you are inside the window and the scope, and you are in the client's telemetry — hence the activity log. Encryption protects content, not the existence, timing or volume of a conversation, which is why even a TLS- heavy capture still maps who talks to whom. On an engagement this runs only on a segment the scope names; here it is the lab network you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.