Watch what a tunnel hides and what it does not

short · 40 min · Objective 3.2

Task

Capture the same request twice — once in the clear and once inside an encrypted tunnel — and record exactly which fields disappeared. A VPN protects data between its endpoints, and seeing what survives is how that stops being a slogan.

Steps

  1. On the Linux VM, serve a page containing a recognisable string: printf 'SECRET-LAB-STRING\n' > index.html then python3 -m http.server 8080 --bind 10.99.0.10.
  2. From the other VM, request it over plain HTTP while capturing on the wire to /tmp/plain.pcap.
  3. Search the capture for the string and confirm it is present in plaintext.
  4. Establish an encrypted tunnel between the two hosts — an SSH local port forward is sufficient and takes one command — and request the same page through it, capturing to /tmp/tunnelled.pcap.
  5. Search the new capture for the same string and confirm it is absent.
  6. Now record what IS still visible in the tunnelled capture: the source and destination addresses, the port, the packet sizes and the timing. Write all of it into /tmp/tunnel.md.

Verify

grep -c "SECRET-LAB-STRING" /tmp/plain.pcap
grep -c "SECRET-LAB-STRING" /tmp/tunnelled.pcap
python3 - <<'PY'
p=open('/tmp/plain.pcap','rb').read(); t=open('/tmp/tunnelled.pcap','rb').read()
s=b'SECRET-LAB-STRING'
print('plaintext capture contains the string:', s in p)
print('tunnelled capture contains the string:', s in t)
assert s in p, 'the plaintext run did not capture the payload'
assert s not in t, 'the string survived the tunnel - the request did not go through it'
PY
grep -ciE "address|size|timing|metadata" /tmp/tunnel.md

Both assertions must pass: present in the first capture, absent in the second. The final grep matters as much — the content is gone and the metadata is not, and a candidate who thinks a VPN makes traffic invisible will get the beaconing questions wrong, because beaconing is detected entirely from what survives.

Notes

What survived is exactly what the Domain 4 monitoring lesson calls flow data: who talked to whom, how much, how often. That is why NetFlow has become more valuable as encryption has spread rather than less.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.