Internet Protocols

Chris Wilson, Aptivate, AfNOG 2014

Questions to get you thinking


Install Wireshark on your computer

Some versions already downloaded, otherwise go to

Capture some traffic

Start a capture (e.g. 1000 packets), look at the traffic and analyse it.

Look out for:

Investigate the properties of the packets by expanding layers at the bottom.

Investigate a DNS packet. What host is being looked up, by who and why?

What’s the source MAC address of your incoming packets? And destination of your outgoing packets? Why?

If you find something interesting/unusual, send a pcap file to the intructor.

Learn how to filter captures

Reading TCP Stream

Drawing Graphs

Network Security

Check for open ports

sudo pkg install nmap

Find out which hosts are up on our LAN, and the whole of AfNOG. Try to identify them.

Check for open ports:

What do the different states mean? open/closed/filtered

What difference does it make if you stop your firewall?

What can you do with these ports?

Try connecting to one:

What log messages do you get when someone hits these services?

Do you see other such records?