Intro to Network Traffic Analysis

4 min readJul 11, 2026

--

TCPDump

Question 1: Utilizing the output shown in “question-1.png”, who is the server in this communication? (IP Address)

Answer : after downloading the file you’ll find an image.

if we read the first packet sent it is the “SYN” packet of the three-way handshake TCP, in other words the client 192.168.1.140 using a random port 57678 sending a syn packet to the http (80) server 174.143.213.184

Question 2: Were absolute or relative sequence numbers used during the capture? (see question-1.zip to answer)

Answer : the tcpdump is on relative mode because as we can see it begin with a raw initial sequence number, then start to normalise every syn/ack so it start counting from 1 (ack 1)

Question 3: If I wish to start a capture without hostname resolution, verbose output, showing contents in ASCII and hex, and grab the first 100 packets; what are the switches used? please answer in the order the switches are asked for in the question.

Answer :

-nvXc 100

-n : do not convert addresses 
-v : verbose output
-X : showning content in ASCII and hex
-c 100 : grab the first 100 packets

Question 4: Given the capture file at /tmp/capture.pcap, what tcpdump command will enable you to read from the capture and show the output contents in Hex and ASCII? (Please use best practices when using switches)

Answer :

sudo tcpdump -Xr /tmp/capture.pcap

-r : read from a file

Question 5: What TCPDump switch will increase the verbosity of our output? ( Include the — with the proper switch )

Answer :

-v : verbose output

Question 6: What built in terminal help reference can tell us more about TCPDump?

Answer :

man

Question 7: What TCPDump switch will let me write my output to a file?

Answer :

-w : write into a file

Wireshark Advanced Usage

Question 1: Which plugin tab can provide us with a way to view conversation metadata and even protocol breakdowns for the entire PCAP file?

Answer : statistics

Question 2: What plugin tab will allow me to accomplish tasks such as applying filters, following streams, and viewing expert info?

Answer : Analyze

Question 3: What stream oriented Transport protocol enables us to follow and rebuild conversations and the included data?

Answer : TCP Stream

Question : True or False: Wireshark can extract files from HTTP traffic.

Get Abdelhamid Houari’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Answer : True

Question : True or False: The ftp-data filter will show us any data sent over TCP port 21.

Answer : False, the ftp-data filter will show us any data sent over TCP port 20 not 21

Packet Inception, Dissecting Network Traffic With Wireshark

Question 1: What was the filename of the image that contained a certain Transformer Leader? (name.filetype)

Answer : after importing the given pcap file, used http && image-jfif as a display filter to include only HTTP packets with JPEG Files.
and 3 images where there.

export those images so we can check them.

!! Transformer Leader !!

Question 2: Which employee is suspected of performing potentially malicious actions in the live environment?

Answer : after some digging and testing diffrent protocols you will notice that the ip 172.16.10.2 is suspicious.

Couldn’t retrieve the employee from the ftp traffic, so i moved to http, there was a POST method — chance for credentials, so followed the stream, and the employee name was there the name is [REDACTED].