README.md

Network Security Groups (NSGs) and Inspecting Traffic Between Azure Virtual Machines

We will use Wireshark to observe network traffic between Azure Virtual Machines and experiment with Network Security Groups.

Environments and Technologies Used

• Microsoft Azure (Virtual Machine Deployment)
• Wireshark (Packet Analyzer)
• RDP
• Various Command-Line Tools
• Various Network Protocols (ICMP, SSH, DHCP, HTTP/S, etc.)

Operating Systems Used

• Windows 10 (21H2)
• Ubuntu Server 20.04

High-Level Steps

• Deploying the VMs on Azure
• Preparing the Wireshark
• Observing the traffic of different network protocols
• Cleaning up the lab

Actions and Observations

1. Access the Azure Portal

Begin by navigating to the Azure Portal.

2. Create the Resource Group

Create a resource group named "LAB-Wireshark."

3. Create Two Virtual Machines

Set up two virtual machines within the resource group:

• Windows VM (Private IP: 10.0.0.4)
• Ubuntu VM (Private IP: 10.0.0.5)

4. Virtual Network Configuration

Both virtual machines should be created within the same Virtual Network (VNet).

For more detailed documentation on the creation of the virtual machines, you can see here: https://github.com/shoganaich/azure-osticket/wiki/1.-Prerequisites-and-Virtual-Machine-Setup

5. Remote Desktop Connection

Connect to the Windows VM using Remote Desktop Protocol (RDP).

6. Install Wireshark

Download and install Wireshark on the Windows VM.

7. Monitor ICMP Traffic

7a. Ping Ubuntu VM

Test the connectivity by pinging the Ubuntu VM and observe the ICMP traffic.

7b. Ping Google.com

Check the connectivity with google.com.

7c. Continuous Ping

Initiate a continuous ping between both VMs.

7d. Block ICMP Traffic

Create an inbound rule in the Network Security Group to block all ICMP traffic.

7e. Observe Blocked Traffic

Notice that all ICMP traffic between the machines is blocked.

7f. Delete Rule

After removing the rule, observe the restoration of normal traffic flow.

8. SSH Traffic Monitoring

8a. Initiate SSH Connection

Start an SSH session between the Windows VM and the Ubuntu VM, and observe SSH traffic.

8b. Monitor Commands

Observe the requests and replies with each command typed in the terminal.

9. Inspect DHCP Traffic

Type the command ipconfig /renew on the Windows VM to request a new IP address from the DHCP server, and monitor the DHCP traffic.

10. RDP Traffic Analysis

Inspect the RDP session traffic, which shows a continuous flow as the session remained active throughout the lab. Specifically, inspect the TCP traffic on port 3389 to analyze the RDP traffic in detail.

11. Cleanup Resources

Delete the entire resource group to prevent unnecessary costs after the lab is complete.

Conclusion and Next Steps

This lab demonstrates network traffic setup and monitoring within an Azure environment using Wireshark. By following these steps, you have learned how to create virtual machines, configure a virtual network, and analyze different types of network traffic, including ICMP, SSH, DHCP, and RDP. These exercises are crucial for understanding network behavior and troubleshooting issues.

I highly recommend that you take a deeper dive into this topic by tweaking the network settings, trying out different types of traffic, and utilizing additional monitoring tools. This will not only improve your comprehension of network management and security but also spark your curiosity and drive to explore further.

Thank you for experiencing this lab. If you have questions or would like to explore more advanced scenarios, please reach out through the issues section of this repository or submit pull requests with your suggestions to improve this lab.

License

Distributed under the MIT License. See LICENSE for more information.

Acknowledgments

• Wireshark
• Course Carrers
• Josh Madakor