Intelligent Systems for Cybersecurity

MACHINE LEARNING CYBERSECURITY

CUPTURING NETWORK TRAFFIC

LAB 3: CUPTRING NETWORK TRAFFIC

Lab Description: Capturing network traffic is important for troubleshooting,
analysis, and software and communications protocol development. For the security-
minded individual, monitoring network traffic is crucial for detecting malicious
activity or policy violation. In this lab, we will demonstrate how to capture and
inspect network traffic.

Getting Ready: In preparation for this recipe, observe the following steps: 1.
Install pyshark: pip install pyshark 2. Install wireshark. The latest version can be
found at https://www.wireshark. org/download.html.

How to do it…

In the following steps, we utilize a Python library named PyShark, along

with Wireshark, to capture and examine network traffic.

1. You must add tshark to PyShark's configuration path. Tshark is a

command line variant of Wireshark. To do this, run the following command:

pip show pyshark

Note the location of the package. In the pyshark directory in this location,
find the file, config.ini. Edit tshark_path to the location of tshark inside your
wireshark installation folder. Similarly, edit dumpcap_path to the location of
dumpcap inside your wireshark installation folder

Steps 2 and 4 should be executed in a Python environment. Note that, as of

the current version, pyshark may have some bugs when run in a Jupyter notebook.

2. Import pyshark and specify the duration of the capture:

Pr. Meryeme Ayache Page | 1

 Intelligent Systems for Cybersecurity

3. Specify the name of the file to output the capture, to:

4. Capture network traffic:

5. To examine the capture, open the pcap file in Wireshark:

Q1: How it works…

Write a small paragraph explaining the main steps of the lab you just
have finished before.

Pr. Meryeme Ayache Page | 2

 Intelligent Systems for Cybersecurity

WHAT TO SUBMIT

You should submit a lab report file which includes:

 The steps for how you preprocessed data
 The screenshot of the results
 You can name your report "Lab_NeworkTraffic_yourname.doc".

Pr. Meryeme Ayache Page | 3