Week 2 Day 1 — NETW-0014 Advanced Operating Systems

0:00–0:25
Lecture

0:25–1:50
Lab 2A

1:50–2:00
Debrief

0:00 – 0:25Lecture · 25 min

tcpdump on a GUI-less server, then Mausezahn to generate what we're capturing

Part 1 — tcpdump flags and BPF filters (15 min)

Open with: "Your DNS server is intermittently not responding, you're on SSH with no GUI — how do you see what's happening on the wire?" — tcpdump. Same libpcap engine as Wireshark; .pcap files it writes open directly in Wireshark.
Flag reference: -i interface, -n/-nn no name/port resolution, -v/-vv/-vvv verbosity, -c N packet count, -s 0 full snap length, -w file.pcap write, -r file.pcap read, -A ASCII payload, -X hex+ASCII, -e layer-2 headers. Show the common combo sudo tcpdump -i eth0 -nvvXSs 0 on the projector and walk one packet line by line.
BPF filters: types (host, net, port), directions (src, dst), protocols (tcp, udp, icmp, arp), combined with and/or/not. Capture vs. display filter — a capture filter decides what's written to disk; a display filter only changes what's shown when reading a saved file. Ask: "Which is better for forensics?" — capture everything, filter later. You can't recover what was never captured.
Demo the two-TTY workflow on the projector before the lab: one SSH session runs tcpdump, a second generates traffic. Two Windows Terminal tabs are simpler than switching Hyper-V console TTYs.

Part 2 — Mausezahn: crafting packets, including spoofed sources (10 min)

mz is a fast packet generator — unlike ping, it can craft almost any packet type with any source address and payload. Flags: -c N count, -d N delay (ms), -t [type] icmp/udp/tcp/arp/dns, -A [IP] source IP (can be spoofed), -B [IP] destination IP, -a/-b [MAC] source/dest MAC, -P [string] ASCII payload.
Security framing: -A lets you put any IP in the source field — including one you don't own. That's IP spoofing at the packet level, the same mechanism behind SYN-flood and reflection DDoS attacks. mz is a legitimate testing tool; understanding it helps students recognise the attack pattern in logs later.

Instructor note: tcpdump's filter language appears in every remaining week as the verification tool of choice. Don't rush the BPF section even under time pressure — students who treat it as a black box will struggle every time a service misbehaves later in the course.

0:25 – 1:50Lab 2A · 85 min

Lab 2A — Capture and filter with tcpdump, then generate and verify with Mausezahn

Part 1 — Basic capture and filters (30 min)

Two SSH sessions to S1. Session 1: sudo tcpdump -i eth0. Session 2: ping 172.17.0.1 — watch ICMP appear in Session 1, stop with Ctrl+C, count packets.
Add a protocol filter (icmp), then verbose hex (-nvvXSs 0 -c 2 icmp) — identify IP header, ICMP type/code, sequence number, and payload in the output.
Build and test five filter expressions (host, port, direction combinations — see handout), write a capture to ~/tcpdumpinfo.pcap while generating pings from Session 2, then read it back with -r and apply a display filter for ICMP replies only.

Part 2 — Mausezahn: ICMP, UDP with payload, spoofed-source TCP (40 min)

Install: sudo apt install mz (fallback: hping3 if unavailable — instructor will advise). Two Windows Terminal sessions: S1 sends, S2 receives with tcpdump running.
ICMP: sudo mz eth1 -c 10 -t icmp -B [S2-IP] — verify 10 packets arrive on S2's tcpdump.
UDP with payload, by MAC: sudo mz eth1 -c 15 -t udp -b [S2-MAC] -P "PacketFromStudent" — capture on S2 with -A -n udp and find the payload string. Answer: why does tcpdump show 255.255.255.255 as the destination IP when only a MAC was specified?
Spoofed-source TCP: sudo mz eth0 -c 1 -t tcp -A 10.0.0.99 -B 172.17.0.1 — verify with tcpdump that the source shown is 10.0.0.99, an address S1 doesn't own. Discuss: would the gateway's reply ever reach S1? Why is this hard to trace? How does a SYN flood use the same technique?

Optional take-home extension (on the handout): the compound BPF expression drill (interpreting 4 additional filters before running them), the DNS-query and HTTP-header capture exercises, the valid-ping-with-reply and broadcast-ping mz experiments, and the mz DNS packet type. All were part of the original two-day version and remain excellent practice.

1:50 – 2:00Debrief · 10 min

Ask: "Mausezahn lets you send packets with any source IP. What does that tell you about trusting the source IP field?" — you can't; it's advisory, not authenticated, at the host level.
Preview Tuesday: now that we can see traffic and generate it, we write rules to control it — IPTables, NFTables, and UFW, all in one day.

Learning outcomes — by end of Day 1, students can…

Apply tcpdump flags and BPF filtersUse -i, -n, -v, -c, -s, -w, -r, -A, -X correctly and construct compound host/port/protocol filters

Distinguish capture from display filtersExplain the difference and choose correctly for a forensic scenario

Generate packets with MausezahnCraft ICMP, UDP-with-payload, and spoofed-source TCP packets and verify each with tcpdump

Explain IP spoofing at the packet levelDescribe how a spoofed source is used in SYN-flood and reflection attacks

What you need ready before class

All three VMs running and SSH accessible Lab 2A handout printed Verify mz package available (apt show mz) Wireshark installed on Windows host for .pcap viewing demo

← Week 2 Overview Lab 2A Handout Day 2 →