Prove a sensor is blind to the traffic you care about

short · 40 min · Objective 3.2

Task

Place a capture at a gateway, generate traffic that never crosses it, and show that the sensor records nothing — the east-west blind spot, demonstrated rather than described. It answers the first of the lesson's three placement questions, what traffic must this device see, with a packet count instead of a diagram.

Steps

  1. Identify the two positions: the host's gateway-facing interface, and the segment the two VMs share.
  2. Start a capture at the gateway position, writing to /tmp/gateway.pcap, filtered to traffic between your two lab hosts.
  3. Generate traffic between the two VMs that stays on their own segment — a few HTTP requests between 10.99.0.10 and 10.99.0.20.
  4. Stop the capture and count the packets it recorded involving those two addresses.
  5. Now start a capture on the segment itself, repeat the same traffic, and count again.
  6. Write /tmp/placement.md with both counts and a sentence on which attacker activity would be invisible to the first position.

Files the Verify reads

The Verify block reads these by name, so save them exactly here:

  • /tmp/segment.pcap -- the capture on the segment itself from step 5.

Verify

tshark -r /tmp/gateway.pcap -Y "ip.addr==10.99.0.20" 2>/dev/null | wc -l
tshark -r /tmp/segment.pcap -Y "ip.addr==10.99.0.20" 2>/dev/null | wc -l
python3 - <<'PY'
import subprocess
def n(p):
    r=subprocess.run(['tshark','-r',p,'-Y','ip.addr==10.99.0.20'],
                     capture_output=True,text=True)
    return len([l for l in r.stdout.splitlines() if l.strip()])
g,s=n('/tmp/gateway.pcap'),n('/tmp/segment.pcap')
print('gateway position saw',g,'packets | segment position saw',s)
assert s>0, 'the segment capture saw nothing - the traffic was not generated'
assert g<s, 'the gateway saw as much as the segment - the hosts are not on a shared segment'
PY

The assertion requires the gateway capture to have seen strictly less than the segment capture. That gap is the blind spot, and it is the reason lateral movement is the activity most organisations cannot see: it happens between two hosts on the same segment and never passes the device that is watching.

Notes

This is the argument for pairing network and endpoint telemetry from the Domain 4 monitoring lesson. The endpoint agent sees what happened on the host regardless of where the traffic went, which is exactly the visibility a gateway sensor cannot have.

This is an independent study companion for CompTIA Security+ SY0-801 and is not produced by or endorsed by CompTIA.