Prove a sensor is blind to the traffic you care about

short · 40 min · Objective 3.2

Task

Place a capture at a gateway, generate traffic that never crosses it, and show that the sensor records nothing — the east-west blind spot, demonstrated rather than described.

Steps

  1. Identify the two positions: the host's gateway-facing interface, and the segment the two VMs share.
  2. Start a capture at the gateway position, writing to /tmp/gateway.pcap, filtered to traffic between your two lab hosts.
  3. Generate traffic between the two VMs that stays on their own segment — a few HTTP requests between 10.99.0.10 and 10.99.0.20.
  4. Stop the capture and count the packets it recorded involving those two addresses.
  5. Now start a capture on the segment itself, repeat the same traffic, and count again.
  6. Write /tmp/placement.md with both counts and a sentence on which attacker activity would be invisible to the first position.

Verify

tshark -r /tmp/gateway.pcap -Y "ip.addr==10.99.0.20" 2>/dev/null | wc -l
tshark -r /tmp/segment.pcap -Y "ip.addr==10.99.0.20" 2>/dev/null | wc -l
python3 - <<'PY'
import subprocess
def n(p):
    r=subprocess.run(['tshark','-r',p,'-Y','ip.addr==10.99.0.20'],
                     capture_output=True,text=True)
    return len([l for l in r.stdout.splitlines() if l.strip()])
g,s=n('/tmp/gateway.pcap'),n('/tmp/segment.pcap')
print('gateway position saw',g,'packets | segment position saw',s)
assert s>0, 'the segment capture saw nothing - the traffic was not generated'
assert g<s, 'the gateway saw as much as the segment - the hosts are not on a shared segment'
PY

The assertion requires the gateway capture to have seen strictly less than the segment capture. That gap is the blind spot, and it is the reason lateral movement is the activity most organisations cannot see: it happens between two hosts on the same segment and never passes the device that is watching.

Notes

This is the argument for pairing network and endpoint telemetry from the Domain 4 monitoring lesson. The endpoint agent sees what happened on the host regardless of where the traffic went, which is exactly the visibility a gateway sensor cannot have.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.