CloudLabBox
Try the free demo

Packet analysis lab 11 of 12

Security signs: scans and ARP spoofing with DNS tunnelling

Something on the office LAN is misbehaving. From a tap in front of the server you find a port scan and the ports it found open, an ARP spoofing attempt against the server's address, and data leaving in DNS queries, decode what was stolen, and save the evidence for the incident report.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 3,584 MB in total. That fits the free demo too.

In your workspace: Shared, then Packet analysis with Wireshark and tcpdump guided labs, then 11 - Security signs - scans and ARP spoofing with DNS tunnelling

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 70 minutes
Nodes need
4 vCPU, 3,584 MB
Smallest plan
Lite

The scenario

Fellside Outdoor's file server SRV has been "slow and odd" since Monday, and CL, a normal office PC, keeps losing it for a few seconds at a time. Someone also noticed a lot of DNS traffic at night. You've placed your workstation WS as a tap between the office LAN and SRV. Find out what is happening, which host is doing it, and what it has taken, from packets alone.

DeviceInterfaceAddressNotes
CLeth010.120.0.21/24office PC: uses SRV's web pages and DNS
PC7eth010.120.0.66/24office PC: "runs a software updater"
WSbr0 (eth0 + eth1)10.120.0.50/24your tap between the LAN and SRV
SRVeth010.120.0.10/24file server: HTTP 80, FTP 21, SSH 22 and the office DNS (UDP 53)

Your workstation, WS. Open WS's console (a remote desktop, root / eve), start Wireshark from Applications > Internet > Wireshark and open a terminal. Write answers in /root/answers.txt (pluma /root/answers.txt &).

What you’ll practise

  • Recognise a TCP port scan and read which ports answered from SYN, SYN-ACK and RST patterns
  • Spot ARP spoofing from gratuitous ARP replies and Wireshark's duplicate-address warning
  • Recognise DNS tunnelling from query names, lengths and volume, and decode the data
  • Use conversations, endpoints and filters to find the one host behind several signs
  • Export the evidence for an incident report

The tasks

  1. Start the normal user
  2. Capture and get an overview
  3. The port scan
  4. ARP spoofing
  5. Data leaving through DNS

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Security signs - scans and ARP spoofing with DNS tunnelling4 nodes and 1 network, 4 links. Every link is listed as text below the diagram.CLPC7WSSRVOfficeeth0eth0eth0eth1eth0
4 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • CL eth0 to Office (network)
  • PC7 eth0 to Office (network)
  • WS eth0 to Office (network)
  • WS eth1 to SRV eth0
Nodes in Security signs: scans and ARP spoofing with DNS tunnelling, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
CLAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
PC7EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
WSEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
SRVEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Packet analysis with Wireshark and tcpdump guided labs.

  3. Open 11 - Security signs - scans and ARP spoofing with DNS tunnelling and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Packet analysis labs

All Packet analysis labs

Related labs in other courses

CloudLabBox is independent of the Wireshark Foundation, CompTIA and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.