Network challenges: clues in the traffic
With captures and live targets you answer who talks to whom, what is leaking and which rule is missing.
Level 201 · 15 lessons · 15 practice labs
Lessons
Who talks to whom
- The host sending the most data
- A device that just joined the network
- Two MACs claiming one IP
- A rogue DHCP server
- Short task: list every conversation in the capture by bytes
What is leaking
- Cleartext login details
- Long, random DNS names
- Carving a downloaded file from traffic
- The host that connects every 60 seconds
- Short task: hash the leaked file and report it
Which rule is missing
- A management port open to everyone
- Guest network reaching the server network
- Rate-limiting an ICMP storm
- Opening only the needed outbound ports
- Capstone: review an office network's traffic and propose a firewall policy
Practice labs
- Learn the server software from response headers: You read the server software and version from the web responses in a capture and submit them in flag format.
- Find the retransmissions behind a slow app: You find the connection slowing Mavikoy Otel's booking screen from retransmission counts and write the server address and the rate to the result file.
- Find in the handshake why an encrypted connection fails: From the handshake messages you identify the version or cipher suite the client and server fail to agree on and write the cause and the proposed setting to the result file.
- Find the client that keeps asking for a name that doesn't exist: In a capture you find the mistyped domain that always gets a negative answer and the client asking for it and submit the flag.
- Find the device using a resolver outside the company: On Çınaraltı Koleji's network you find the device querying another server instead of the approved resolvers and write its address and query count to the result file.
- Find who sends an unexpected IPv6 router advertisement: You identify the device sending advertisements that change clients' default route and write its hardware address and your proposed countermeasure to the result file.
- Read the subject of an email sent unencrypted: You find an email sent without encryption in a capture and submit the flag in its subject line.
- Catch an access key carried in an unencrypted request: On Yelkenli Yazılım's test network you find an access key sent in an unencrypted request and write which client sent it and your rotation advice to the result file.
- Uncover data hidden in echo packets: You piece together the payloads of unusually large echo requests, recover the text carried and submit the flag inside.
- Find the device probing the network and how many ports it tried: In a capture you find the source trying many ports in a short time and submit its address and the port count in flag format.
- Monitoring system or probing: tell them apart: Of two sources that poll regularly you tell from behaviour which is the registered monitoring server and write your reasoning to the result file.
- Tell a flood of half-open connections from a real rush: You decide from connection patterns whether the rush on Nehirsu Enerji's customer site is an attack or campaign traffic and write your rate-limit proposal to the result file.
- Leave the database port to the app server only: You work out from a capture who connects to the database and write a rule allowing only the app server to the result file.
- Derive an allow list for a kiosk network from a day of traffic: From a capture you extract the destinations and ports Tunçbey Hukuk's waiting-room kiosks really use and write the tightest allow list to the result file.
- Check a ruleset against traffic and correct it: You find shadowed, never-matching and over-broad rules in an existing ruleset by comparing it with a capture and write the corrected policy to the result file.
About this course
With captures and live targets you answer who talks to whom, what is leaking and which rule is missing.
What you will learn
- Who talks to whom
- What is leaking
- Which rule is missing
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.