NSG and Network Protocols Project

Environments and Technologies Used

• Microsoft Azure (Virtual Machines/Compute)
• Remote Desktop
• Firewall and Network Security Groups
• Wireshark

Operating Systems Used

• Windows 11
• Ubuntu Linux

Project Overview

I will be using Azure to create a virtual network that has a Windows virtual machine and a Ubuntu Linux virtual machine. I will be performing some activities in the network between the virtual machines. I will use Wireshark a network analyzer to observe the interactions across the network. I will also change some rules on the firewall to observe the impact that it has across the network.

Virtual Machine Creation

I created a resource group that acted as a repository for this project and that holds both virtual machines.

I created the virtual machines one with Ubuntu Linux and one with Windows.

Observe ICMP Traffic

I used Remote Desktop to connect to the Windows 11 virtual machine

On the Windows 11 virtual machine I downloaded and installed Wireshark

I used the command line to ping the private IP address of the Linux virtual machine

I used Wireshark to filter for ICMP traffic and observed the traffic between the two computers after pinging the Linux Virtual Machine

I pinged www.google.com and used Wireshark to observe the interaction

I issued a perpetual ping from the Windows virtual machine to the Linux virtual machine

I then disabled the inbound ICMP traffic on the Network Security Group of the Linux virtual machine

Disabling the inbound ICMP traffic blocked the ping traffic and caused the Linux virtual machine not to respond. In Windows Virtual Machine command line the request for a ping reply from Linux began to time out.

Observe SSH Traffic

From the Windows virtual machine command line I used SSH to connect to the Linux virtual machine

Then I filtered to view ssh (port 22) traffic only in Wireshark.

Observe DHCP Traffic

The computer uses DHCP to automatically assign an IP address so when I used the command (ipconfig /renew) it issued the Windows virtual machine a new IP address

I filtered to view DHCP (port 67) traffic only in Wireshark

Observe DNS Traffic

I used nslookup to see what google.com and Disney.com’s IP addresses were

I filtered to view DNS (port 53) traffic only in Wireshark

Observe RDP Traffic

I filtered to see RDP (port 3389) traffic only in Wireshark. Wireshark displays an immediate nonstop spam of RDP traffic because we are connected to the virtual machine with remote desktop. It is showing all the traffic from my personal computer, the virtual machine, and Azure servers.