Demonstrate Network Understanding Through Traffic Analysis and Implementation
8 weeks · 0 milestones
Capture real network traffic from your own machine using Wireshark (your IP address must be visible in the capture file), implement a working TCP client/server from scratch using raw sockets (not a framework), and write a report explaining how your specific captured traffic maps to each layer of the protocol stack. The report must explain what each packet header field means in the context of your capture — not as a textbook definition. Proof: the capture file, the working code, and the report reviewed by a CS lecturer or network engineer who provides a previously-unseen packet capture and asks you to diagnose what is happening at each protocol layer.
Milestone map
Milestone map
3 milestones
Study the TCP/IP model: physical, network, transport, and application layers. Capture real network traffic with Wireshark and analyse at least five different protocols at multiple layers (e.g. HTTP, DNS, TCP handshake, ICMP, ARP). For each capture, identify the headers at each relevant layer and explain in writing what each field means and why it is there.
Proof required
Submit: Wireshark capture files (pcap format) for at least five different protocols; a written analysis (at least 200 words per protocol) identifying the relevant headers at each layer and explaining each field; and evidence that the captures are from real traffic you captured — not downloaded sample pcap files. A CS lecturer, network engineer, or systems programmer must review the analyses and confirm in writing that the protocol interpretations are correct.
What gets checked
- Five or more protocols are analysed with real captured traffic — not downloaded sample pcap files
- Each analysis covers headers at multiple layers and explains each field — not just names the fields
- A network engineer or CS lecturer has confirmed the protocol interpretations are correct