LAB-01Network analysis

SYN-flood detection with Wireshark and tcpdump

Objective

Capture a TCP SYN flood against a lab web server and prove it apart from legitimate traffic bursts.

Environment

Kali attacker, Ubuntu Server target and a monitoring VM on an isolated host-only segment.

What I did

Baselined normal traffic, generated the flood, then filtered on half-open connections and compared SYN to SYN-ACK ratios per source.

Results

Isolated the spoofed sources, measured the retransmission pattern and wrote a reusable display filter for triage.

What I learned

Volume alone is not the signal — the handshake asymmetry is. That distinction is what stops a SOC from escalating a marketing campaign as an attack.

Tools

Wiresharktcpdumphping3Ubuntu Server
Terminal output
$ tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0'
14:02:11.884 IP 10.0.0.9.443 > target.80: Flags [S]
14:02:11.884 IP 10.0.0.9.443 > target.80: Flags [S]
... 18,412 SYN / 96 SYN-ACK in 10s
filter: tcp.flags.syn==1 && tcp.flags.ack==0