- Microsoft Azure (Virtual Machines)
- Remote Desktop
- Azure Network Security Groups -Wireshark
- Windows 10 (version 22H2) -Windows and Linux (Ubuntu) for Azure Virtual Machines. -Wireshark
Overview
1. Create a resource group in Azure. Mine is called "network group".
- Create a Windows 10 Virtual Machine (VM). This virtual machine will be connected to the resource group we previously created.
3. Create a Linux Ubuntu VM. While creating the VM, select the previously created resource group and vnet.
4. Observe the network you created within Network Watcher
5. Use Remote Desktop to connect to your Windows 10 Virtual Machine
6. Within your Windows 10 Virtual Machine, Install Wireshark
- Open Wireshark and filter for ICMP traffic only
8. Retrieve the private IP address of the Ubuntu VM and attempt to ping it from within the Windows 10 VM. Observe your ping requests and replies within Wireshark.
- From The Windows 10 VM, open the command line or PowerShell and attempt to ping a public website (such as www.google.com) and observe the traffic in Wireshark.
- Initiate a perpetual/non-stop ping from your Windows 10 VM to your Ubuntu VM. Try disabling incoming ICMP traffic from the Network Security Group your Ubuntu uses. Then, try enabling the traffic once more.
- Back in Wireshark, filter for SSH traffic only
- From your Windows 10 VM, “SSH into” your Ubuntu Virtual Machine (via its private IP address) Type commands (ls, pwd, etc) into the linux SSH connection and observe SSH traffic spam in WireShark Exit the SSH connection by typing ‘exit’ and pressing [Enter].
-SSH traffic commands to try out: pw,ls.
-
Back in Wireshark, filter for DHCP traffic only. Observe the DHCP traffic appearing in Wireshark.
-
From your Windows 10 VM, attempt to issue your VM a new IP address from the command line (ipconfig/renew). Observe the DHCP traffic appearing in Wireshark.
-
Back in Wireshark, filter for DNS traffic only
-
From your Windows 10 VM within a command line, use nslookup to see what google.com and disney.com’s IP addresses are
17.Back in Wireshark, filter for RDP traffic only (tcp.port == 3389)
-
Observe the immediate non-stop spam of traffic. This traffic seems to be nonstop because the RDP (protocol) is constantly showing you a live stream from one computer to another, therefore traffic is always being transmitted
-
Close your Remote Desktop and delete your resource group and all other resources used in the lab.
















