// Network Traffic Analysis & Wireshark

Packets don't lie. Network Traffic Analysis (NTA) is the process of capturing, inspecting, and interpreting the data that moves across a network to understand behavior, diagnose problems, and detect malicious activity — a hands-on Wireshark live demo from the UNG Cyber Unit workshop.

// Download

Class Capture (.pcapng) The packet capture used in the demo below Workshop Slides (.pptx) Full walkthrough this challenge is drawn from

// Meet Wireshark

A free, open-source packet analyzer that captures traffic on a network interface and displays it in human-readable detail — live capture, opens .pcap/.pcapng files from other tools, and deep protocol dissection (HTTP, DNS, TCP, TLS, and more).

Packet List Top pane — one row per packet: time, source, destination, protocol, summary
Packet Details Middle pane — an expandable tree of every protocol layer in the selected packet
Packet Bytes Bottom pane — the raw hex and ASCII bytes of the selected packet
http Display filter — show only HTTP traffic
tcp.port == 23 Display filter — traffic on a specific port (here, Telnet)
ip.addr == x.x.x.x Display filter — traffic to/from a specific IP address

// The Challenge

Telnet (TCP port 23) sends everything — including usernames and passwords — as plain, unencrypted text over the network. It's still found on legacy devices and older lab equipment, and it's a textbook example of why NTA matters for a defender.

Live Demo

Viewing Cleartext Credentials in Wireshark

Reconstruct a Telnet session from the capture and read the login straight off the wire.

  1. Open the class capture file (wireshark-101-class-capture.pcapng)
  2. Filter on tcp.port == 23 to isolate the Telnet session
  3. Right-click any packet in that conversation, then Follow → TCP Stream
  4. Read the reconstructed session top to bottom
  5. Spot the username and password sitting in plain text
Target file: wireshark-101-class-capture.pcapng

// Capture Responsibly

Only capture traffic on networks you own, or where you have explicit written authorization to test. Unauthorized packet capture can violate the Computer Fraud and Abuse Act (CFAA) and similar state laws. Club labs, personal home networks, and NCL/CTF ranges are fair game — production or public networks are not. When in doubt, ask leadership before you sniff.

// References & Resources

wireshark.org ↗  ·  Sample Captures ↗  ·  Display Filters ↗