Week Overview
Mon – Fri · 10 hours total
Four topics, one week — condensed from the original two-week sequence
NETW-0014 has been shortened from 8 weeks to 7. This week absorbs what used to be two separate weeks — Network Analysis & Packet Filtering, and Time Sync & Centralised Logging — into one. Nothing has been cut outright: every command, concept, and lab task from the original two weeks is still here or on the lab handout as an optional take-home extension. What changed is pacing. Each of the four original two-day sub-topics (packet capture/generation, firewall tools, NTP, logging) now gets one focused day instead of two.
Monday covers tcpdump and Mausezahn together — seeing traffic, then generating it. Tuesday covers all three firewall tools (IPTables, NFTables, UFW) plus NAT and persistence in one pass. Wednesday builds the NTP server and its clients in a single day. Thursday covers rsyslog end-to-end — local routing, the custom template, and centralised logging with rotation. Friday is the combined assessment.
Week at a glance
Monday
tcpdump & Mausezahn
BPF filters, .pcap files, then crafting ICMP/UDP/TCP packets with spoofed sources (Lab 2A)
Tuesday
Firewalling — IPTables, NFTables, UFW
Filter table chains, NFTables handles, UFW rules, NAT masquerade, rule persistence (Lab 2B)
Wednesday
NTP Server & Clients
Stratum hierarchy, ntp.conf on S1, timesyncd clients on S2/S3, restrict ACLs (Lab 2C)
Thursday
rsyslog — Local & Centralised Logging
Facilities/severities, custom template, 50-default.conf redirection, S2→S1 forwarding, logrotate (Lab 2D)
Friday
Mini-Assessment 2
Written: tcpdump/mz/firewall/NTP/logging theory. Practical: implement rules + diagnose a seeded log scenario.
Learning Outcomes
By end of Week 2, students can…
Capture and generate trafficUse tcpdump with BPF filters and .pcap files; craft ICMP/UDP/TCP packets with Mausezahn, including spoofed sources
Write firewall rules in three toolsImplement matching rule sets in IPTables, NFTables, and UFW; explain DROP vs. REJECT and rule ordering
Configure NAT and persistenceSet up masquerade NAT through UFW and persist iptables rules across reboots
Build an NTP time hierarchyConfigure S1 as a stratum-2 NTP server and S2/S3 as clients, with restrict ACLs, verified via ntpq -p
Configure rsyslog end-to-endAdd a custom log template, redirect facilities to new files, and centralise S2's auth logs on S1
Configure log rotationWrite a logrotate rule with daily rotation, compression, retention, and a postrotate script
MondayLecture + Lab 2A · 2 hrs
tcpdump capture and filters, then Mausezahn packet generation
0:00–0:25
Lecture
0:25–1:50
Lab 2A
1:50–2:00
Debrief
- Lecture (25 min): tcpdump flag reference (-i, -n, -v, -c, -s, -w, -r, -A, -x) and BPF filter syntax (host/net/port/portrange, src/dst, tcp/udp/icmp). Capture filter vs. display filter — capture everything, filter later. Then Mausezahn: -c, -d, -t, -A (spoofed source IP), -B, -a/-b (MAC), -P (payload) — and why a spoofed source IP matters for DoS/reflection attacks.
- Lab 2A (85 min): Two-TTY workflow — capture on one session, generate on another. Build filter complexity in stages (bare capture → protocol → host → port → compound expressions), write and read back a .pcap file. Then install mz and send ICMP, UDP-with-payload, and a spoofed-source TCP packet from S1 to S2, verifying each with a targeted tcpdump capture on S2.
Optional take-home extension (on the Lab 2A handout): the full complex-filter drill set (interpreting 4 additional compound expressions), the DNS/HTTP-header capture exercises, and the broadcast-ping/DNS-query mz experiments. All were part of the original two-day version and remain excellent practice — just not required today.
TuesdayLecture + Lab 2B · 2 hrs
IPTables, NFTables, and UFW — three tools, one job, then NAT and persistence
0:00–0:10
Recap
0:10–0:35
Lecture
0:35–1:50
Lab 2B
1:50–2:00
Debrief
- Lecture (25 min): Netfilter architecture — packet flow through PREROUTING/INPUT/FORWARD/OUTPUT/POSTROUTING, the filter and nat tables. IPTables rule anatomy (-t, -A/-D/-F/-L, -p, -s/-d, --dport, -j). NFTables: no predefined tables, address families, handle-based deletion. UFW as a simplified front-end. DROP vs. REJECT.
- Lab 2B (75 min): Implement a short rule set (drop ICMP from S2, deny telnet, permit SSH from S2 only) in IPTables, then the same rules in NFTables — verifying each with tcpdump before removing it. Repeat once more in UFW, including a subnet restriction. Enable UFW's masquerade NAT (sysctl.conf, default/ufw, before.rules) and persist the IPTables ruleset with iptables-persistent.
Rule ordering: the ACCEPT-before-DROP ordering mistake (Task 6 style: allow one source, deny everything else) is the single most common error — demonstrate it deliberately before students hit it themselves.
Optional take-home extension (on the Lab 2B handout): the full six-task rule set from the original Lab 2C/2D (DNS-only-from-S2, interface-specific SSH block, gateway-only ICMP), the connection-tracking (conntrack -L) bonus, and the three-tool comparison writeup. All remain excellent practice.
WednesdayLecture + Lab 2C · 2 hrs
Building the NTP hierarchy — server on S1, clients on S2/S3
0:00–0:10
Recap
0:10–0:35
Lecture
0:35–1:50
Lab 2C
1:50–2:00
Debrief
- Lecture (25 min): Why accurate time matters — log correlation, TLS validity windows, Kerberos skew, scheduled tasks. Stratum hierarchy (0 = reference clock, 1 = directly connected, 2 = our S1, 3 = S2/S3). timesyncd vs. the full ntpd. ntpq -p column reference (remote, refid, st, t, when, poll, reach, delay, offset, jitter).
- Lab 2C (75 min): On S1 — set timezone, disable timesyncd, install ntp, edit ntp.conf with Canadian pool servers, verify with ntpq -p. On S2 and S3 — point timesyncd at S1 via timesyncd.conf, verify stratum 3 with timedatectl timesync-status, confirm with a tcpdump capture of UDP 123 on S1. Add restrict ACLs on S1 limiting queries to the LAN1/LAN2 subnets.
Optional take-home extension (on the Lab 2C handout): the host-specific restrict-ACL experiment (temporarily locking out S3 to observe the FallbackNTP behaviour), and the written NTP-ACL-vs-firewall comparison. Good practice, not required today.
ThursdayLecture + Lab 2D · 2 hrs
rsyslog — facilities, severities, the custom template, and centralised logging
0:00–0:10
Recap
0:10–0:35
Lecture
0:35–1:50
Lab 2D
1:50–2:00
Debrief
- Lecture (25 min): The syslog standard — facility (auth, kern, daemon, cron, local0-7) and severity (0 emerg – 7 debug). rsyslog.conf vs. 50-default.conf. The custom log template (myDefault) adding facility/severity to every line. Centralised logging: imudp reception on S1, @loghost forwarding from S2, and why local logs alone are forensically weak.
- Lab 2D (75 min): Snapshot first. Add the custom template on S1, redirect auth logs to a new file and verify. Enable UDP reception bound to S1's LAN1 IP, add S2's @loghost forwarding line (keeping local logging too), and confirm delivery with a live tail on S1 while triggering logins on S2. Verify with tcpdump that syslog is plaintext. Write a logrotate rule (daily, rotate 5, compress, sharedscripts, postrotate) and a crontab entry to schedule it. Restore from snapshot.
Optional take-home extension (on the Lab 2D handout): the second-facility redirect exercise (kern.* → NewLog.log), the full six-log-file research table (auth.log, syslog, kern.log, dpkg.log, dmesg, wtmp), and the omusrmsg live-terminal bonus. All were part of the original two-day version.
FridayMini-Assessment 2 · 2 hrs
Mini-Assessment 2 — packet analysis, firewalling, NTP, and logging
0:00–0:20
Written
0:20–1:45
Practical
1:45–2:00
Review
- Written (20 min): tcpdump/mz flag identification and filter construction, IPTables/NFTables/UFW rule interpretation, DROP vs. REJECT, NTP stratum and ntpq -p columns, syslog facility/severity table, rsyslog and logrotate directive meanings.
- Practical (85 min): Students receive a firewall specification to implement on S1 with a tool of their choice, verified with tcpdump. They then diagnose a pre-seeded auth.log scenario (identify the attacking IP, the breach time, commands run as root) and restore a deliberately broken rsyslog configuration so logging resumes.
- Review + Week 3 Preview (15 min): Go over common mistakes. Preview Week 3: DHCP and DNS — the two services that let machines find each other by name. The DNS zones built this week are referenced in every subsequent week.
Mini-Assessment 2 — Topic Coverage
| Topic | Weight | Source |
|---|
| tcpdump flags, BPF filters, capture vs. display | 15% | Monday |
| Mausezahn syntax and packet crafting | 10% | Monday |
| IPTables / NFTables / UFW rule syntax and DROP vs. REJECT | 25% | Tuesday |
| NTP stratum hierarchy and ntpq -p columns | 15% | Wednesday |
| Syslog facility/severity and rsyslog routing rules | 15% | Thursday |
| Practical: firewall implementation + log diagnosis + rsyslog repair | 20% | All week |
What you need ready before Monday
All three VMs running from Week 1 with SSH working
Lab 2A, 2B, 2C, 2D handouts printed
Verify mz package available on Ubuntu 24.04 (apt show mz)
Confirm ntp package is available in apt on Ubuntu 24.04
Seeded auth.log file prepared for Friday practical
Mini-Assessment 2 printed (Friday)