CN5 Wireshark: capture TCP/IP packets, 3-way handshakeTerminal (Ctrl+Alt+T): sudo wireshark Double-click your interface (moving line: enp0s3 / eth0 / wlo1) Second terminal: run the command for your case (below) Click the RED square to stop Type the filter in the green bar > Enter Click a packet > look at the middle pane > screenshot Screen 1: after sudo wireshark (double-click the highlighted interface)
File Edit View Go Capture Analyze Statistics Telephony Wireless Tools Help
↻ ⚙ | 🔍 ← →
Apply a display filter ... <Ctrl-/>
Welcome to Wireshark · Capture
enp0s3 ▁▂▅▃▇▂
any ▁▂▄▂▆▁
Loopback: lo ▁▁▁▂▁▁
bluetooth-monitor
nflog
Ready to load or capture Profile: Default
Screen 2: capture stopped, filter typed (tcp) - first 3 rows = 3-way handshake
File Edit View Go Capture Analyze Statistics Telephony Wireless Tools Help
↻ ⚙ | 🔍 ← →
tcp
No. Time Source Destination Protocol Length Info 1 0.000000 192.168.1.5 34.223.124.45 TCP 74 51812 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 2 0.231184 34.223.124.45 192.168.1.5 TCP 74 80 → 51812 [SYN, ACK] Seq=0 Ack=1 Win=26847 Len=0 3 0.231240 192.168.1.5 34.223.124.45 TCP 66 51812 → 80 [ACK] Seq=1 Ack=1 Win=64256 Len=0 4 0.231377 192.168.1.5 34.223.124.45 HTTP 141 GET / HTTP/1.1 5 0.462903 34.223.124.45 192.168.1.5 TCP 66 80 → 51812 [ACK] Seq=1 Ack=76 Win=27008 Len=0 6 0.463551 34.223.124.45 192.168.1.5 HTTP 2894 HTTP/1.1 200 OK (text/html)
▸ Frame 1: 74 bytes on wire (592 bits)
▸ Ethernet II, Src: 08:00:27:3a:1b:7e, Dst: 52:54:00:12:35:02
▸ Internet Protocol Version 4, Src: 192.168.1.5, Dst: 34.223.124.45
▸ Transmission Control Protocol, Src Port: 51812, Dst Port: 80, Seq: 0, Len: 0 (Flags: SYN)
Packets: 214 · Displayed: 38 Profile: Default
A. 3-way handshake (most common) Command: curl http://neverssl.com Filter: tcp First 3 rows: [SYN] > [SYN, ACK] > [ACK] Write Source IP, Destination IP, Seq/Ack: SYN Seq=0 | SYN-ACK Seq=0 Ack=1 | ACK Seq=1 Ack=1 Diagram: Statistics > Flow Graph B. TCP/IP layers Click any TCP packet, middle pane shows: Frame = Physical | Ethernet II = Data Link (MAC) | Internet Protocol = Network (IP) | TCP = Transport (ports) | HTTP = Application C. Monitor browsing habits Open 3-4 websites in Firefox while capturing Filter dns: Info column lists every site name looked up Filter tls.handshake.extensions_server_name: HTTPS sites Statistics > Conversations and Statistics > Protocol Hierarchy: screenshot both If something goes wrong No interfaces listed: you forgot sudo. Close and run sudo wireshark again Filter bar is red: typo in the filter (green = correct) Nothing after the filter: you stopped too early. Start again, run the command, then stop No HTTP packets: HTTPS is encrypted. Use curl http://neverssl.com Commandscopy
sudo wireshark
curl http://neverssl.com Filters (green bar)copy
tcp
udp
dns
http
icmp
arp
ip.addr == 8.8.8.8
tcp.port == 80
tcp.flags.syn==1
tls.handshake.extensions_server_name If not installed (say Yes to non-superusers)copy
sudo apt install -y wireshark
video not playing? open on YouTube
video not playing? open on YouTube What is Wireshark? Free packet analyser that captures and shows network traffic.
3 panes? Packet list (top), packet details / layers (middle), raw bytes in hex (bottom).
Capture filter vs display filter? Capture filter decides what is recorded; display filter (green bar) only hides packets after capture.
3-way handshake? SYN > SYN-ACK > ACK to start a TCP connection. Close: FIN, ACK, FIN, ACK.
Why can't you read HTTPS? It is encrypted; only IPs, ports and site name are visible.
CN7 TCP socket programming (client-server, reverse sentence)gedit tcp_server.c > paste SERVER > save. gedit tcp_client.c > paste CLIENT > save Terminal 1: gcc tcp_server.c -o server then ./server Terminal 2: gcc tcp_client.c -o client then ./client Type a sentence > reverse comes back. Ctrl+D to stop SERVER tcp_server.ccopy
/* EXP 7: TCP Server - receives a sentence, sends back its reverse (port 5777) */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <sys/socket.h>
#define PORT 5777
#define MAX 1024
int main(void) {
int listenfd, connfd, n, i;
char line[MAX], rev[MAX];
struct sockaddr_in servaddr, cliaddr;
socklen_t clilen = sizeof(cliaddr);
listenfd = socket(AF_INET, SOCK_STREAM, 0); /* 1. socket */
int opt = 1;
setsockopt(listenfd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
memset(&servaddr, 0, sizeof(servaddr));
servaddr.sin_family = AF_INET;
servaddr.sin_addr.s_addr = htonl(INADDR_ANY);
servaddr.sin_port = htons(PORT);
if (bind(listenfd, (struct sockaddr *)&servaddr, sizeof(servaddr)) < 0) { /* 2. bind */
perror("bind"); exit(1);
}
listen(listenfd, 5); /* 3. listen */
printf("Server waiting on port %d...\n", PORT);
connfd = accept(listenfd, (struct sockaddr *)&cliaddr, &clilen); /* 4. accept */
printf("Connected to client %s\n", inet_ntoa(cliaddr.sin_addr));
while ((n = read(connfd, line, MAX - 1)) > 0) { /* 5. read */
line[n] = '\0';
if (line[n - 1] == '\n') line[--n] = '\0';
printf("Received : %s\n", line);
for (i = 0; i < n; i++) rev[i] = line[n - 1 - i]; /* reverse */
rev[n] = '\0';
write(connfd, rev, n + 1); /* 6. write */
printf("Sent back: %s\n", rev);
}
printf("Client disconnected\n");
close(connfd);
close(listenfd); /* 7. close */
return 0;
} CLIENT tcp_client.ccopy
/* EXP 7: TCP Client - sends a sentence, prints the reversed reply (port 5777) */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <sys/socket.h>
#define PORT 5777
#define MAX 1024
int main(void) {
int sockfd, n;
char sendline[MAX], revline[MAX];
struct sockaddr_in servaddr;
sockfd = socket(AF_INET, SOCK_STREAM, 0); /* 1. socket */
memset(&servaddr, 0, sizeof(servaddr));
servaddr.sin_family = AF_INET;
servaddr.sin_port = htons(PORT);
servaddr.sin_addr.s_addr = inet_addr("127.0.0.1"); /* server IP */
/* 2. connect */
if (connect(sockfd, (struct sockaddr *)&servaddr, sizeof(servaddr)) < 0) {
perror("connect"); exit(1);
}
printf("Connected. Enter sentences (Ctrl+D to quit):\n");
while (fgets(sendline, MAX, stdin) != NULL) {
write(sockfd, sendline, strlen(sendline)); /* 3. write */
n = read(sockfd, revline, MAX - 1); /* 4. read */
if (n <= 0) break;
revline[n] = '\0';
printf("Reverse of the given sentence is: %s\n", revline);
}
close(sockfd); /* 5. close */
return 0;
}
video not playing? open on YouTube CN8 UDP socket programming (chat until exit)Save udp_server.c and udp_client.c (gedit) Terminal 1: gcc udp_server.c -o userver then ./userver Terminal 2: gcc udp_client.c -o uclient then ./uclient Client types first, server replies, exit to stop SERVER udp_server.ccopy
/* EXP 8: UDP Server - two-way chat with client until "exit" (port 5777) */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <sys/socket.h>
#define PORT 5777
#define MAX 1024
int main(void) {
int sockfd, n;
char buf[MAX];
struct sockaddr_in servaddr, cliaddr;
socklen_t len = sizeof(cliaddr);
sockfd = socket(AF_INET, SOCK_DGRAM, 0); /* 1. socket (UDP) */
memset(&servaddr, 0, sizeof(servaddr));
servaddr.sin_family = AF_INET;
servaddr.sin_addr.s_addr = htonl(INADDR_ANY);
servaddr.sin_port = htons(PORT);
if (bind(sockfd, (struct sockaddr *)&servaddr, sizeof(servaddr)) < 0) { /* 2. bind */
perror("bind"); exit(1);
}
printf("UDP server waiting on port %d...\n", PORT);
while (1) {
/* 3. recvfrom */
n = recvfrom(sockfd, buf, MAX - 1, 0, (struct sockaddr *)&cliaddr, &len);
buf[n] = '\0';
printf("Client: %s\n", buf);
if (strncmp(buf, "exit", 4) == 0) break;
printf("Server: ");
if (!fgets(buf, MAX, stdin)) break;
buf[strcspn(buf, "\n")] = '\0';
/* 4. sendto */
sendto(sockfd, buf, strlen(buf), 0, (struct sockaddr *)&cliaddr, len);
if (strncmp(buf, "exit", 4) == 0) break;
}
printf("Chat ended\n");
close(sockfd);
return 0;
} CLIENT udp_client.ccopy
/* EXP 8: UDP Client - two-way chat with server until "exit" (127.0.0.1:5777) */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <sys/socket.h>
#define PORT 5777
#define MAX 1024
int main(void) {
int sockfd, n;
char buf[MAX];
struct sockaddr_in servaddr;
socklen_t len = sizeof(servaddr);
sockfd = socket(AF_INET, SOCK_DGRAM, 0); /* 1. socket (UDP) */
memset(&servaddr, 0, sizeof(servaddr));
servaddr.sin_family = AF_INET;
servaddr.sin_port = htons(PORT);
servaddr.sin_addr.s_addr = inet_addr("127.0.0.1");
while (1) {
printf("Client: ");
if (!fgets(buf, MAX, stdin)) break;
buf[strcspn(buf, "\n")] = '\0';
/* 2. sendto */
sendto(sockfd, buf, strlen(buf), 0, (struct sockaddr *)&servaddr, len);
if (strncmp(buf, "exit", 4) == 0) break;
/* 3. recvfrom */
n = recvfrom(sockfd, buf, MAX - 1, 0, NULL, NULL);
buf[n] = '\0';
printf("Server: %s\n", buf);
if (strncmp(buf, "exit", 4) == 0) break;
}
printf("Chat ended\n");
close(sockfd);
return 0;
}
video not playing? open on YouTube CN6 Wireshark: security threats and suspicious trafficTerminal (Ctrl+Alt+T): sudo wireshark Double-click your interface (moving line: enp0s3 / eth0 / wlo1) Second terminal: run the command for your case (below) Click the RED square to stop Type the filter in the green bar > Enter Click a packet > look at the middle pane > screenshot Port scan (sudo nmap -sS 127.0.0.1, capture on Loopback: lo, filter tcp.flags.syn==1)
File Edit View Go Capture Analyze Statistics Telephony Wireless Tools Help
↻ ⚙ | 🔍 ← →
tcp.flags.syn==1
No. Time Source Destination Protocol Length Info 1 0.000000 127.0.0.1 127.0.0.1 TCP 58 34754 → 111 [SYN] Seq=0 Win=1024 Len=0 MSS=1460 3 0.000035 127.0.0.1 127.0.0.1 TCP 58 34754 → 110 [SYN] Seq=0 Win=1024 Len=0 MSS=1460 5 0.000043 127.0.0.1 127.0.0.1 TCP 58 34754 → 23 [SYN] Seq=0 Win=1024 Len=0 MSS=1460 7 0.000050 127.0.0.1 127.0.0.1 TCP 58 34754 → 135 [SYN] Seq=0 Win=1024 Len=0 MSS=1460 9 0.000098 127.0.0.1 127.0.0.1 TCP 58 34754 → 53 [SYN] Seq=0 Win=1024 Len=0 MSS=1460 11 0.000106 127.0.0.1 127.0.0.1 TCP 58 34754 → 80 [SYN] Seq=0 Win=1024 Len=0 MSS=1460
▸ one source port → many destination ports in milliseconds = PORT SCAN (suspicious)
Packets: 403 · Displayed: 202 Profile: Default
Case Command Filter Normal Suspicious DNS nslookup google.com dns query + response hundreds of queries, long random names ICMP ping -c 10 8.8.8.8 icmp request + reply pairs huge number of pings from one IP (ICMP flood) ARP ping -c 2 <your gateway> arp Who has X? Tell Y + X is at MAC one IP with 2 different MACs (ARP spoofing) HTTP curl http://neverssl.com http GET + 200 OK passwords visible in plain text Port scan sudo nmap -sS 127.0.0.1 tcp.flags.syn==1 - one IP sends SYN to many ports in ms
Notes Your gateway: ip route | grep default Port scan: capture on 'Loopback: lo'. Install nmap if needed: sudo apt install -y nmap Exercise table: 5-6 packets: Packet No | Source IP | Destination IP | Protocol | Description | Normal / Suspicious If something goes wrong No interfaces listed: you forgot sudo. Close and run sudo wireshark again Filter bar is red: typo in the filter (green = correct) Nothing after the filter: you stopped too early. Start again, run the command, then stop No HTTP packets: HTTPS is encrypted. Use curl http://neverssl.com Commandscopy
nslookup google.com
ping -c 10 8.8.8.8
ip route | grep default
ping -c 2 192.168.0.1
curl http://neverssl.com
sudo apt install -y nmap
sudo nmap -sS 127.0.0.1 Filterscopy
dns
icmp
arp
http
tcp.flags.syn==1
arp.duplicate-address-detected
video not playing? open on YouTube VIVA per experimentCN1 ping uses? ICMP echo request / reply | TTL? Max hops; each router -1; 0 = dropped | ARP? IP address > MAC address
CN2 Default gateway? Router used when no route matches (0.0.0.0) | Flag G? Route goes via a gateway | Permanent? No, lost on reboot
CN3 Hub vs switch? Hub sends to all ports; switch only to the right MAC | Mesh links for n? n(n-1)/2, 4 PCs = 6 | Straight vs cross? Straight: different devices; cross: same devices
CN4 Static vs dynamic? Static typed by admin; dynamic learned automatically | RIP metric? Hop count, max 15, updates every 30 s | AD values? Connected 0, static 1, RIP 120
CN5 3-way handshake? SYN > SYN-ACK > ACK | TCP vs UDP? TCP reliable, connection; UDP fast, no connection | 3 panes? Packet list, details, bytes
CN6 ARP spoofing? Fake ARP replies to steal traffic (MITM) | Port scan sign? Many SYN from one IP to many ports | Why HTTP risky? Plain text, passwords visible
CN7 SOCK_STREAM? TCP socket | Server calls? socket, bind, listen, accept, read/write, close | htons? Port to network byte order
CN8 SOCK_DGRAM? UDP socket | No listen/accept? UDP is connectionless | Calls? sendto, recvfrom
CN9 DHCP steps? DORA: Discover, Offer, Request, Ack | SMTP vs POP3? SMTP sends (25); POP3 receives (110) | DHCP ports? UDP 67 / 68