Network Security Groups (NSGs) and Inspecting Traffic Between Azure Virtual Machines

A project demonstrating how to observe various network traffic to and from Azure Virtual Machines with Wireshark as well as experiment with Network Security Groups.

Environments and Technologies Used

• Microsoft Azure (Virtual Machines/Compute)
• Remote Desktop
• Various Command-Line Tools
• Various Network Protocols (SSH, RDH, DNS, HTTP/S, ICMP)
• Wireshark (Protocol Analyzer)

Operating Systems Used

• Windows 10 (22H2)
• Ubuntu Server 22.04

High-Level Steps

- Create Azure Resource Group - Create Windows 10 and Ubuntu VM - Install Wireshark on Windows 10 VM - Generate the following network traffic(ICMP, SSH, DNS, DHCP, RDP) - Observe traffic within Wireshark - Enable/Disable traffic using Network Security Group - Clean up lab once finished

Actions and Observations

First we create our Resource Group and Virtual Machines

Make sure to have the Windows VM create a new virtual network and subnet

For the Ubuntu VM we will use the virtual network created by the Windows VM

We then use the windows vm's virtual ip to remote into it using Remote Desktop Connection

(Make sure to use the username you set during setup to login)

Inside the Windows VM, install Wireshark

Once we have this all setup, we can begin observing network protocol traffic by clicking the blue fin on the top left

Starting of with ICMP, simply type on the search bar to filter the traffic

Next we will ping our Ubuntu VM from our Windows VM and we can see traffic being sent in Wireshark

(Make sure to use the VM's private IP address and not the public one

Go over to the Ubuntu VM's Network Security Group and create a new rule to deny ICMP requests

Pinging the VM again will result in timeouts

From this exercise we know now enough to observe traffic of any network protocol.

SSH traffic

In our Windows VM, login to the Ubuntu VM using powershell and ssh

DHCP traffic

On Command Prompt, issue the Windows VM a new IP address using the command 'ipconfig /renew'

DNS traffic

Go back to Command Prompt and use the command 'nslookup' to generate DNS traffic

RDP traffic

When we filter for RDP traffic (tcp.port == 3389), there will a nonstop stream of traffic. This is because the RDP (protocol) is constantly showing you a live stream from one computer to another, therefor traffic is always being transmitted

That concludes the Lab and make sure to clean up everything created in Azure to avoid accruing unneccessary costs