Skip to content
← Back to projects
Network Sniffing: tcpdump, Wireshark & Scapy — cover image
Personal project

Network Sniffing: tcpdump, Wireshark & Scapy

tcpdump · Wireshark · Scapy · VMware Workstation Pro 17

Context

This project is the "network layer" counterpart to an earlier password-cracking project. Where that project showed how a stored password can be guessed, this one demonstrates how a password in transit can be read directly if it isn't encrypted.

The goal: capture raw network traffic with the industry's three reference tools (tcpdump, Wireshark, Scapy), read the exact anatomy of a packet, and concretely demonstrate — by intercepting an FTP credential sent in plaintext — why protocols like FTP or Telnet are now considered dangerous in production.

Objectives

  • Capture and analyze raw network traffic with tcpdump and Wireshark (ARP, ICMP, TCP).
  • Demonstrate plaintext reading of a full HTTP exchange via Follow HTTP Stream.
  • Intercept FTP credentials sent without encryption.
  • Build a custom network sniffer in Python with Scapy.

Project walkthrough

  1. 1
    Baseline capture with tcpdump
    I captured ARP and ICMP traffic between the two lab machines, saved it to .pcap, and replayed it from the command line.
  2. 2
    Visual analysis with Wireshark
    I opened the capture and explored the packet anatomy layer by layer (Ethernet → IP → TCP/ICMP), applying display filters.
  3. 3
    Plaintext HTTP interception
    I started a test HTTP server, captured the targeted traffic, and read the full request and response via Follow HTTP Stream.
  4. 4
    FTP credential interception
    I deployed a test vsftpd server, connected with a dedicated account, and read the login/password directly in cleartext in the Wireshark packet list.
  5. 5
    Custom Python sniffer (Scapy)
    I wrote a script capturing and analyzing ARP/TCP/UDP traffic live, and successfully tested it on real traffic (ARP resolution, active SSH session).

Results

Protocols analyzed
ARP, ICMP, TCP, HTTP, FTP
FTP credentials intercepted in plaintext
1 (USER + PASS)
Packets captured (Scapy script)
live ARP + TCP traffic
Tools mastered
3 (tcpdump, Wireshark, Scapy)

Key takeaway

Sniffing never "breaks" encryption: an observer capturing HTTPS or SSH traffic sees unreadable bytes, not content. This project illustrates why widespread TLS adoption has made passive sniffing largely obsolete as a direct threat to content — the real risk today lies in legacy plaintext protocols (FTP, Telnet) and traffic metadata.

Stack & tools

  • Kali Linux (capture + traffic generation) and Debian (target), on VMware Workstation Pro 17
  • tcpdump (command-line capture, BPF filtering)
  • Wireshark (visual analysis, Follow HTTP Stream)
  • Scapy / Python (custom network sniffer)
  • vsftpd (test FTP server)

Screenshots

Network Sniffing: tcpdump, Wireshark & Scapy — screenshot 1 of 8