Lesson 2 of 9

Network Protocols Deep Dive

Network protocols are the languages that computers use to communicate, and understanding their weaknesses is fundamental to network security. You will examine DNS, HTTP, HTTPS, FTP, SMTP, and other common protocols at the packet level to understand what information they expose. Many classic network attacks exploit protocol design flaws that have existed for decades.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is asking you to build a clear mental model of the concept — not just memorize a definition, but genuinely understand what it means, why it exists, and how it connects to everything else you are learning. When you can explain "how DNS, HTTP, FTP, and SMTP work at the packet level" in your own words to someone who has never heard of it, you have truly learned it.

Why this matters

Every attack and every defense happens over a network. Understanding how data actually travels between computers gives you the mental model to spot anomalies, intercept traffic, and understand why certain attacks work the way they do.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Network Protocols Deep Dive · Objective 1 of 4

VIDEO

Loading video…

Set up an FTP server on Metasploitable

Boot your Metasploitable 2 VM and confirm it is on the same host-only network as your Kali machine. Metasploitable runs vsftpd 2.3.4 on port 21 by default — verify it is listening by running 'nmap -p 21 <metasploitable-ip>' from Kali. Note the IP address of the Metasploitable VM, as you will need it for all subsequent steps. A common pitfall is having the VMs on different network segments; both should be on the same host-only adapter in VirtualBox or VMware.

Start a Wireshark capture

On your Kali machine, open Wireshark and start capturing on the host-only interface before initiating any FTP connection. Starting the capture first is critical — if you connect to FTP before Wireshark is running, you will miss the authentication packets. Apply a capture filter of 'host <metasploitable-ip>' to reduce noise and focus only on traffic to and from the target. Confirm the capture is active by watching the packet counter increment.

Connect to FTP and log in

Open a terminal on Kali and run 'ftp <metasploitable-ip>' to connect to the FTP server. When prompted, enter the username 'msfadmin' and password 'msfadmin' — the default credentials on Metasploitable. Watch Wireshark as you type each credential; FTP sends them in plaintext over the wire, so every character is visible in the capture. After logging in, run a simple 'ls' command to generate additional FTP traffic, then type 'quit' to close the session.

Find the credentials in Wireshark

In Wireshark, apply the display filter 'ftp' to show only FTP control channel packets. Look for packets with the Info field showing 'Request: USER msfadmin' and 'Request: PASS msfadmin' — these contain the plaintext credentials. Click the PASS packet and expand the FTP layer in the packet details pane to see the full password value. This exercise demonstrates exactly why FTP is considered insecure and should never be used on production systems — use SFTP or FTPS instead.

Document the finding

Take a screenshot of the Wireshark packet showing the plaintext PASS command with the full password visible. In a real penetration test, this screenshot would be included in your report as evidence of the vulnerability. Note the source and destination IP addresses, the port number, and the timestamp of the capture. Write a one-paragraph finding that describes the vulnerability (cleartext credential transmission), the evidence (packet capture), and the recommended remediation (replace FTP with SFTP or disable FTP entirely).

Previous: TCP/IP Fundamentals Next Lesson