Module Title: dgt_net02 – Packet Sniffing
Module Description:
dgt_net02 – Packet Sniffing is an advanced-level module on packet sniffing in networking, covering network traffic analysis and security monitoring. It is intended for IT professionals, network engineers and cybersecurity enthusiasts.
Packet sniffing involves capturing and analyzing data packets as they traverse a network. In this module you will study how it works and then put it into practice with tcpdump, the most widely used packet-sniffing tool, in real-world scenarios. You will not type tcpdump commands yourself: you will tell the machine, in natural language, what traffic you want to observe and why, then read the filter it builds and the capture it returns, and judge whether they really answer your question.
Module Objectives:
-
Understand the Basics of Network Protocols: Learn about the protocols that govern data transmission across networks.
-
Tcpdump: Understand tcpdump well enough to describe a capture precisely to the machine on Unix-like systems, read every option and filter it proposes, and interpret the packets it shows you.
-
Explore Practical Applications: Study real-world applications of packet sniffing, from troubleshooting network issues to strengthening security.
-
Ethical Considerations: Learn the ethical implications of packet sniffing and understand the legal boundaries of network monitoring, including the limits you must set for the machine before it captures anything.
Key Topics Covered:
-
Introduction to Packet Sniffing: What packet sniffing is and why it is crucial in networking.
-
Deep Dive into Tcpdump: Installation, syntax, basic options and advanced features of tcpdump, studied so that you can verify any command the machine produces.
-
Analyzing Network Traffic: Techniques for inspecting packet data, including headers and payloads.
-
Filtering and Capturing Packets: How capture filters work, and how to phrase a request so that the machine captures only the traffic you actually need.
-
Real-world Examples with Tcpdump:
- Network Troubleshooting: Ask the machine to capture traffic with tcpdump to diagnose performance issues such as latency or packet loss, and interpret the evidence yourself.
- Security Monitoring: Have the machine capture suspicious activity, such as unauthorized access attempts or data exfiltration, and check that its conclusions are supported by the packets.
-
Protocol Analysis: Examine specific protocols for compliance and performance assessment.
-
Case Studies and Natural-Language Exercises: Interactive sessions in which you solve network challenges by instructing the machine in plain language, reviewing the tcpdump commands it runs and correcting its interpretation when it gets it wrong.
-
Ethical and Legal Considerations: The boundaries of packet sniffing, ensuring compliance with privacy laws and organizational policies.
Target Audience:
This module is intended for anyone interested in networking technologies or responsible for network security, including IT professionals and cybersecurity specialists.
Approach:
The module puts theory first and then applies it through natural-language practice.
By the end of the module, you will be able to direct tcpdump captures through natural-language instructions in a variety of scenarios, verify what the machine captures and explains, and use that evidence to monitor and secure networks efficiently.
The students can push their exercises to the Academy DevOps & SRE Git project. For this module, create a folder with your username as its name in the following subfolder: https://github.com/Garanti-Del-Talento/gdt_academy