Christopher Stassinos
Labs / Private Project Brief
Packet Analysis · Traffic Investigation

NetworkTraffic Analysis

A protocol-level analysis lab built around Wireshark, tcpdump, and Kali Linux to inspect packets the way a responder actually would: capture the traffic, reduce noise, reconstruct what happened, and document the findings clearly.

  • Worked across live captures and packet traces covering HTTP, FTP, DNS, ARP, and core TCP behavior rather than staying inside one protocol silo.
  • Used filters, stream reconstruction, and protocol metadata to expose cleartext credentials, unusual broadcast behavior, and signs of spoofing or reconnaissance.
  • Built a repeatable triage workflow that moves from packet capture to protocol breakdown to concise findings for detection and incident review.
Back to portfolio Download CV
Approach

How traffic gets turned into evidence

The lab is built around disciplined packet triage. Start broad enough to understand the conversation, narrow fast with protocol and host filters, then follow the stream until the activity becomes explainable. Instead of treating packet captures like screenshots, the workflow focuses on sequence, context, and what each packet proves about the behavior on the wire.

Capture first, then reduce

Traffic is collected live or opened from saved PCAPs, then reduced with protocol, host, and conversation-level filters so the relevant flow becomes readable.

Reconstruct the session

Follow TCP streams, inspect headers, and correlate request/response behavior to recover what users, hosts, and services were actually doing.

Write findings, not guesses

The output is a clean explanation: what protocol was involved, what the packets showed, why the behavior matters, and what a defender should notice next time.

Analyses

Patterns identified in packet traces

Each exercise uses the same posture: isolate the traffic, validate what the protocol is exposing, and convert that packet-level observation into a detection or investigative takeaway.

wireshark > review · packet-notes.txt
Cleartext Credentials in Application Traffic HTTP · FTP Exposure
> Filters http.request or ftp > Method Follow the stream, inspect payloads, and confirm whether usernames, passwords, or session data are readable in cleartext.
ARP Spoofing and Duplicate Mapping Behavior ARP Triage
> Filters arp > Method Look for repeated unsolicited replies, conflicting IP-to-MAC mappings, and abnormal broadcast patterns that suggest man-in-the-middle behavior.
DNS Request Review and Host Intent DNS Context
> Filters dns > Method Extract queried domains, inspect timing and repetition, and use that activity to infer what hosts were attempting to resolve or beacon toward.
TCP Conversation Reconstruction TCP Sequence
> Filters tcp > Method Trace handshake, retransmission, and teardown behavior to understand whether a session completed normally, failed, or behaved in a way worth escalating.
Outcomes

What the lab demonstrates

Protocol fluency

  • Reads packet captures across multiple protocols instead of treating Wireshark as a single-purpose GUI tool.
  • Understands what authentication, discovery, and transport behavior look like on the wire.

Investigation discipline

  • Moves from noisy captures to narrowed evidence with filters, streams, and protocol-specific review steps.
  • Documents findings in a way that supports incident triage, reporting, and future detection logic.

Security relevance

  • Connects packet observations to real defensive concerns like exposed credentials, spoofing, suspicious queries, and abnormal session behavior.
  • Strengthens the network-analysis side of a broader cybersecurity and SOC-oriented skill set.