See the same traffic from three vantage points

short · 45 min · Objective 1.1

Task

Capture one conversation from three places at once and compare what each place can see. Vantage point decides what is detectable, and the difference is much clearer measured than described.

Steps

  1. On the Windows VM (10.10.10.20), serve a file: python -m http.server 8000.
  2. On the Linux VM (10.10.10.10), start three captures before you do anything else -- one at the client, one on the server, one at the host-only switch if your hypervisor allows promiscuous mode:

sudo tcpdump -i eth0 -w /tmp/client.pcap host 10.10.10.20 &

  1. From the Linux VM, fetch the file twice: once over plain HTTP, and once through an SSH tunnel you set up with ssh -L 9000:10.10.10.20:8000 user@10.10.10.20.
  2. Stop the captures. For each capture, count the packets and extract every hostname or URL visible in clear text.
  3. Write down, for each vantage point, the answer to one question: could an analyst here tell which file was requested?

Verify

tcpdump -r /tmp/client.pcap -nn 2>/dev/null | wc -l
tcpdump -r /tmp/client.pcap -A 2>/dev/null | grep -c "GET /"
tcpdump -r /tmp/tunnel.pcap -A 2>/dev/null | grep -c "GET /"

The first count must be non-zero. The second must be non-zero and the third must be zero: the same request, from the same vantage point, is legible in one case and opaque in the other. That gap is the whole lesson, and a capture that shows GET / in both means the tunnel was not actually used.

Notes

Record the packet counts. The tunnelled capture usually has more packets and less information, which is the shape of the problem encryption creates for detection -- volume does not fall, legibility does.

Keep these captures. The packet analysis lab reuses them.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.