SHADOWXLAB CYBER-OS · 30-PHASE INTERACTIVE LAB

Ports, Protocols & Deep Packet Inspection Engine

From the application socket and 5-tuple down to Layer 2 Ethernet frames, transport state machines, Wireshark conversation forensics, and role-aligned operations across SOC, VAPT, Threat Hunting, Firewall Engineering, and Compliance.

PHASE 01 Network Communication: Start With the Socket

Foundational Concept

What actually happens when an application communicates? An application does not speak raw electrical pulses or direct fibers. It opens a socket—the communication doorway managed by the operating system kernel.

1. Communication Stack & Kernel Abstraction

          Application Space (e.g. Chrome browser, ssh, curl)

              │ (POSIX socket() syscall / WinSock2 WSAStartup)

              ▼

          Socket File Descriptor (Kernel OS data structure)

              ├── Local Endpoint: 192.168.1.10:51542 (Ephemeral allocation)

              ├── Remote Endpoint: 93.184.216.34:443 (Target port & IP)

              └── Protocol Family: AF_INET / AF_INET6, SOCK_STREAM / SOCK_DGRAM

              │

              ▼

          Kernel TCP/IP Network Stack (Ring Buffers, TCP Congestion Engine, Routing Table)

              │

              ▼

          Network Interface Controller (NIC) Driver → DMA → PHY Transceiver → Wire

2. Interactive Socket Creation Simulator

Trigger an application request to inspect the live socket creation in kernel space:

Click "Open Socket" to inspect how the OS instantiates the socket descriptor.

PHASE 02 Socket Anatomy & The 5-Tuple Inspector

Network / SIEM Core

Every IP session across the internet is uniquely identified by the 5-Tuple. Firewalls, NetFlow, SIEMs, Wireshark, and IDSs rely on this exact construct to track state and enforce security policy.

Interactive 5-Tuple Inspector

1. SOURCE IP

2. SOURCE PORT (EPHEMERAL)

3. DESTINATION IP

4. DESTINATION PORT

5. TRANSPORT PROTOCOL

          5-Tuple: 10.10.20.15:51542 ──[TCP]──► 142.250.72.14:443
        

Socket Direction, State & Flow Tracking

DIRECTIONOUTBOUND

STATEESTABLISHED

PROCESSchrome.exe (PID 4812)

When the server replies, the Source and Destination reverse: Server 142.250.72.14:443 becomes Source, and Client 10.10.20.15:51542 becomes Destination. The OS matches the incoming segment against its active socket table.

PHASE 03 Critical Distinction: Ports Are NOT Protocols

Security Assessment

A junior tester assumes port 443 is always HTTPS and port 53 is always DNS. A senior analyst knows a port is merely a numeric index. Any protocol can run on any port, and any application can bind to any unreserved port.

Port Range Breakdown

0 – 1023: Well-Known / System Ports (Root/Admin privilege required on Unix)
1024 – 49151: Registered User Ports (IANA designated services)
49152 – 65535: Dynamic / Ephemeral Ports (Client-side temporary allocation)

Multi-Use Port Demystifier

Port 443 can carry:

            • HTTPS (HTTP/1.1 or HTTP/2 over TLS)

            • HTTP/3 (QUIC / UDP 443)

            • OpenVPN / Shadowsocks / Tor Bridges

            • C2 Reverse Shells (bypassing egress filters)

Interactive Port Lookup & Deception

PHASE 04 Transport Layer: TCP vs UDP State Machines

Core Protocol Engineering

TCP provides reliability, connection state, sequencing, flow control, and retransmissions. UDP provides raw, stateless, low-latency datagram transmission with zero overhead.

1. TCP 3-Way Handshake & State Simulation

💻

CLIENT
10.10.20.15

🖥️

SERVER
10.10.20.10

SYN [Seq=0]

TCP CONNECTION TRACKERCLOSED

Ready to initiate TCP 3-Way Handshake.

2. TCP Header Flags & Flow Control Matrix

SYNSynchronize sequence numbers

ACKAcknowledgment field valid

FINGraceful connection teardown

RSTHard reset / port closed

PSHPush data directly to app

URGUrgent pointer valid

Flow Control & Optimization: Window Size advertises receiver buffer capacity; Zero Window signals receiver exhaustion; SACK (Selective ACK) prevents resending already-received segments; Window Scaling allows window sizes up to 1GB over high-bandwidth links.

PHASE 05 From Socket to Packet: Encapsulation & Decapsulation

Architecture

When data leaves an application, each layer prepends its control header (Encapsulation). When the NIC receives raw bits, it strips headers layer-by-layer up to the application (Decapsulation).

Interactive Encapsulation Pipeline

        L7: HTTP Payload ("GET /")
        +
        L4: TCP Header (Ports + Seq)
        +
        L3: IP Header (Src/Dst IPs + TTL)
        +
        L2: Ethernet Frame (MACs + EtherType + FCS)
        =
        WIRE BITS (1010110...)
      

Click Visualize to step through the header encapsulation and decapsulation pipeline.

PHASE 06 Layer 2: Ethernet Frame Analysis

Ethernet II frames encapsulate network packets across physical LAN segments. Inspect the exact byte structure:

          Dest MAC (6B)
          Src MAC (6B)
          EtherType (2B)
          FCS / CRC (4B)
        
          • Dest MAC: 00:0c:29:84:11:ae (Unicast / Gateway)

          • Src MAC: 00:50:56:c0:00:08 (VMware OUI: 00:50:56)

          • EtherType: 0x0800 (IPv4) | 0x86DD (IPv6) | 0x0806 (ARP)

          • VLAN 802.1Q: Tag 0x8100 (3-bit Priority PCP + 12-bit VLAN ID)

PHASE 07 Layer 3: IPv4 & IPv6 Header Dissection

IPv4 headers contain 14 distinct fields; IPv6 streamlines this with a fixed 40-byte base header:

        IPv4 Header: Version=4 | IHL=5 (20B) | DSCP=0 | Total Len=60B

        Ident=0x41f2 | Flags=0x02 (DF - Don't Fragment) | TTL=64

        Protocol=6 (TCP) | Header Checksum=0x83e1 | Src=10.10.20.15 | Dst=10.10.20.10

        IPv6 Header: Version=6 | Traffic Class=0 | Flow Label=0x12a9

        Payload Len=20B | Next Header=6 (TCP) | Hop Limit=64

PHASE 08 ARP & Neighbor Discovery (L2/L3 Binding)

How does an IP find its MAC address on the local wire? ARP Request ("Who has 10.10.20.1?") broadcasts to FF:FF:FF:FF:FF:FF; ARP Reply answers unicast.

ARP TABLE (10.10.20.15)CACHE

Internet Address Physical Address Type 10.10.20.1 00:50:56:ea:32:01 dynamic 10.10.20.10 00:50:56:c0:00:08 dynamic

PHASE 09 DNS Protocol Deep-Dive & Security

DNS is not just port 53. It is a hierarchical record query system (A, AAAA, TXT, MX, CNAME, PTR, NS) prone to tunneling and amplification.

DNS QUERY SIMULATOR

Ready to query DNS resolver.

PHASE 10 HTTP Protocol Dissection & Web Threats

Dissect HTTP requests, status codes (200, 302, 401, 403, 500), headers, cookies, and cleartext credential exposures:

HTTP REQUEST / RESPONSEPORT 80

Select a request above to dissect the plain text application stream.

PHASE 11 TLS / HTTPS Cryptographic Flow & Metadata

Encryption does not make traffic invisible. Even in TLS 1.3, network analysts inspect ClientHello, SNI (Server Name Indication), cipher suites, certs, packet sizes, and flow timing.

TLS 1.3 HANDSHAKE DISSECTORPORT 443

Click simulate to observe what Wireshark captures during a TLS session setup.

PHASE 12 DHCP DORA Sequence

Discover → Offer → Request → Ack (UDP 67/68). Rogue DHCP servers can inject malicious default gateways to execute Man-In-The-Middle attacks.

PHASE 13 ICMP & Tunneling

Type 8 (Echo Request), Type 0 (Echo Reply), Type 3 (Unreachable), Type 11 (TTL Exceeded). Attackers leverage ICMP data payloads for stealth exfiltration.

PHASE 14 SMB / RPC Lateral Movement

TCP 445: Session Setup → Tree Connect → Admin$ / C$. Correlating unexpected internal SMB connections is the primary indicator of ransomware spreading.

PHASE 16 – 18 Interactive Wireshark Workspace & Protocol Dissection

Core Analyst Tool

Experience the real 3-pane Wireshark workflow: Packet List, Packet Details Tree, and Raw Packet Hex/ASCII Bytes with live display filter evaluation.

Display Filter:

No.	Time	Source	Destination	Protocol	Length	Info

Select a packet in the table above to dissect its Layer 2, Layer 3, Layer 4 and Application headers.

0000 00 0c 29 84 11 ae 00 50 56 c0 00 08 08 00 45 00 ..)p...PV...E. 0010 00 3c 41 f2 40 00 40 06 83 e1 0a 0a 14 0f 0a 0a .

PHASE 19 Follow TCP Stream (Application Reconstruction)

A packet is isolated; Follow TCP Stream reassembles the full bidirectional conversation payload as the client and server saw it.

TCP STREAM RECONSTRUCTION #0ASCII / UTF-8

Click button above to follow TCP stream. Client requests will display in red; server responses in blue.

PHASE 20 TCP Troubleshooting & Capture Diagnostics

Distinguish between normal connection state, packet loss, duplicate ACKs, out-of-order delivery, and RST resets:

Select a capture scenario to diagnose network performance and failure modes.

PHASE 21 – 23 Wireshark Statistics, Expert Info & Anomaly Detection

1. Protocol Hierarchy

          ▾ Frame (100% / 1,482 pkts)

            ▾ Ethernet II (100%)

              ▾ IPv4 (94.2% / 1,396 pkts)

                ├── TCP (82.1% / 1,217 pkts)

                │   ├── TLS (68.4%)

                │   └── HTTP (13.7%)

                └── UDP (12.1% / 179 pkts)

                    └── DNS (12.1%)

2. Expert Information Flags

[ERROR] Connection Reset by Peer (RST)
[WARN] TCP Spurious Retransmission
[WARN] Suspected Duplicate ACK (x3)
[NOTE] TLS Handshake SNI: login.finbank.training
[CHAT] HTTP 200 OK Response

3. Protocol Abuse Detector

Identifies high-entropy DNS queries, C2 periodic beacons, and bulk SMB exfiltration:

PHASE 24 – 28 Multi-Role Enterprise Cybersecurity Consoles

SLA & Operations Aligned

Every packet decision drives real security outcomes. Select a cybersecurity role below to execute specialized workflows:

SIEM Alert Log & Triage (SLA: 15 Minutes)

ALERT IDALERT-9824: Suspicious Inbound Connection on Port 4444

Host 10.10.20.15 accepted inbound TCP connection on non-standard port 4444 from external IP 185.44.21.8 followed by interactive shell traffic.

Triage Log

Awaiting SOC Analyst action...

Nmap Port Scanner & Banner Grabbing

Execute scan to identify open ports, service versions, and CVE vulnerabilities.

Vulnerability & CVE Mapping

No scan executed yet. Run nmap scan on target.

Stateful ACL Rule Generator

SOURCE ZONE

DESTINATION PORT

ACTION

Active Firewall Rulebase

Rule 1: ALLOW TCP 80,443 INGRESS TO DMZ
Rule 2: DENY ANY ANY (Default Egress)

MITRE ATT&CK Mapping & Sigma Rule Generator

• T1071.001: Web Protocols C2 (HTTP/S)
• T1071.004: DNS Exfiltration (High query volume)
• T1571: Non-Standard Port Communication (TCP/8443, 4444)
• T1046: Network Service Discovery (SYN Sweeps)

Sigma Detection Rule

Click generate to build Sigma detection logic for non-standard port beaconing.

Regulatory & Framework Compliance Auditor

• PCI-DSS 4.0 Req 1.2: Prohibit insecure cleartext protocols (Telnet 23, FTP 21, HTTP 80) in Cardholder Data Environments.
• NIST SP 800-53 CM-7: Least Functionality — Disable all unapproved ports, protocols, and services.
• ISO/IEC 27001:2022 A.8.20: Network Security controls.

Compliance Gap Report

Click Audit to check environment against PCI-DSS and NIST standards.

PHASE 29 Cyber Pressure SLA Mission Arena

⏳ SLA: 60s

RangeForce-style timed incident response. Analyze the active packet stream, identify the attacking port/protocol, and enforce containment before SLA expiration.

MISSION 01: Critical Ransomware SMB Propagation

Host 10.10.20.15 is scanning the entire 10.10.20.0/24 subnet on TCP 445 (SMB) with high packet velocity. What is the immediate containment action?

PHASE 30 Final Certification Capstone: Comprehensive PCAP Investigation

10-Point Master Triage

Analyze the entire capture file enterprise_breach.pcap and produce the root-cause incident report answering all 10 core triage questions:

10-Point Investigation Matrix

Incident Forensic Verdict & Scorecard

Complete all 10 triage questions to evaluate your forensic investigation report.