{"id":30741802,"url":"https://github.com/kimleeheng/azure-network-protocols","last_synced_at":"2026-05-14T21:05:16.626Z","repository":{"id":303724891,"uuid":"1016472012","full_name":"KimleeHeng/azure-network-protocols","owner":"KimleeHeng","description":"Instructions/tutorial on how to inspect network protocols using Wireshark and Windows Powershell within Azure virtual machines","archived":false,"fork":false,"pushed_at":"2025-07-25T05:16:27.000Z","size":13682,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-07-25T10:44:31.545Z","etag":null,"topics":["azure","dhcp","dns","icmp","network-protocols","networking","ssh","tcp-ip","virtual-machine","windows-powershell","wireshark"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/KimleeHeng.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-09T04:23:13.000Z","updated_at":"2025-07-25T05:16:31.000Z","dependencies_parsed_at":"2025-07-25T07:07:35.943Z","dependency_job_id":"8a870cb6-09f2-46ac-8fc7-be9070cebc8c","html_url":"https://github.com/KimleeHeng/azure-network-protocols","commit_stats":null,"previous_names":["kimleeheng/azure-network-protocols"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/KimleeHeng/azure-network-protocols","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KimleeHeng%2Fazure-network-protocols","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KimleeHeng%2Fazure-network-protocols/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KimleeHeng%2Fazure-network-protocols/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KimleeHeng%2Fazure-network-protocols/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/KimleeHeng","download_url":"https://codeload.github.com/KimleeHeng/azure-network-protocols/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KimleeHeng%2Fazure-network-protocols/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":273534563,"owners_count":25122679,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-03T02:00:09.631Z","response_time":76,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["azure","dhcp","dns","icmp","network-protocols","networking","ssh","tcp-ip","virtual-machine","windows-powershell","wireshark"],"created_at":"2025-09-04T01:02:19.047Z","updated_at":"2025-10-20T04:57:10.241Z","avatar_url":"https://github.com/KimleeHeng.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Network Protocol Inspection in Azure Virtual Environments\n\nThis tutorial outlines the steps on how to observe network traffics and protocols using Wireshark and Windows Powershell within Azure Virtual Machines\n\n## Prerequisites Needed\n- Microsoft Azure Subscription (Free/Pay as you go)\n  \n## Environments Used\n- Microsoft Azure (Cloud Environment)\n- Windows 11 Pro (Virtual Machine OS)\n- Ubuntu Server 24.04 (Virtual Machine OS)\n\n## Technologies Used\n- Azure Virtual Machines\n- Windows Powershell (Commmand-line Shell)\n- Wireshark (Packet Capture \u0026 Analysis)\n- TCP/IP, ICMP, SSH, DHCP, DNS (Network Protocols)\n\n## Content Sections\n- [Create our Resources and Virtual Machines](#Create-our-Resources-and-Virtual-Machines)\n- [Login using RDP and Installing Wireshark](#Login-using-RDP-and-Installing-Wireshark)\n- [Observing ICMP Traffic](#Observing-ICMP-Traffic)\n- [Observing SSH Traffic](#Observing-SSH-Traffic)\n- [Observing DHCP Traffic](#Observing-DHCP-Traffic)\n- [Observing DNS Traffic](#Observing-DNS-Traffic)\n\n## Create our Resources and Virtual Machines\n\n*NOTE: Ensure that you are logged into your Microsoft Azure account, and have a subscription active.*\n\n### Step 1: Create a new resource group within Microsoft Azure\n\n1.1 After logging into your Azure account, navigate to/search for \"Resource Groups\":\n\n![attachments/1.png](attachments/1.png)\n\n1.2 On the Resource Groups page, click Create to start a new resource group:\n\n![attachments/2.png](attachments/2.png)\n\n1.3 Fill out the following information:\n- Select your subscription\n- Name your resource group. For this lab it will be titled **Testing-RG**\n- Choose the region you are residing in. For this lab, we will select **(US) East US**\n\nThen Click Review + create to proceed.\n\n![attachments/3.png](attachments/3.png)\n\nFollowing this, you will be prompted to review your new resource group information on the next page. Ensure the information entered is correct, and then click Create to Proceed.\n\n**A resource group has now succcesfully been created.**\n\n\n### Step 2: Create a Windows 11 Virtual Machine\n\n2.1 Search for \"Virtual Machine\" in the search bar, or navigate to the Virtual Machine section back on the home page.\n\n![attachments/4-VM.png](attachments/4-VM.png)\n\n2.2 On the Virtual Machine page, click **Create**, and then select **Virtual machine**.\n\n![attachments/5-VM_Create.png](attachments/5-VM_Create.png)\n\n2.3 Fill out the following information:\n- Subscription - Select your current and active subscription\n- Resource Group - Select the resource group previously made in Step 1: **\"Testing-RG\"**\n- Virtual machine name - For this lab, we will name our VM:  **\"Windows-VM\"**\n- Region - Select your current region. For this lab, we will select **\"(US) East US\"**\n- Availablity Zone - Select **\"Zone 3\"**\n- Image - Select **\"Windows 11 Pro, version 24H2 - x64 Gen2\"**\n- Size - Select **\"Standard_D2s_v3 - 2vcpus, 8GiB memory ($70.08/month)\"**\n\n![attachments/6-vm_settings.png](attachments/6-vm_settings.png)\n\nCreate your **Administrator account**.\n\n- For this lab, we will use **labuser** as the username and **Cyberlab123!** as the password.\n\nCheck off the Licensing check box\n\nClick **Next: Disks\u003e**, and then **Next: Networking \u003e**\n\n![attachments/7-admin-settings.png](attachments/7-admin-settings.png)\n\n2.4 Click **Create new** under Virtual Network. A window to create a virtual network should pop up\n\n![attachments/8-vnet.png](attachments/8-vnet.png)\n\nCreate your **Virtual Network**\n\n- For this lab, we will use **Lab-VNet** as the name of our virtual network\n\nClick **OK** to proceed\n\n![attachments/9-vnet-pt2.png](attachments/9-vnet-pt2.png)\n\nBack on the Virtual Machine page, Click **Review + Create** to proceed  \n\n![attachments/10-review-create.png](attachments/10-review-create.png)\n\n2.5 Confirm that **Validation passed** for your virtual machine.\n\nReview the the information you inputted, ensuring everything is correct.\n\nClick **Create** once more to initialize deployment of your virtual machine.\n\n![attachments/create-vm.png](attachments/create-vm.png)\n\n**A Windows 11 Virtual Machine has now successfully been created.**\n\n\n### Step 3: Create a Linux (Ubuntu Server) Virtual Machine\n\n3.1 Search for \"Virtual Machine\" in the search bar, or navigate to the Virtual Machine section back on the home page.\n\n![attachments/4-VM.png](attachments/4-VM.png)\n\n3.2 On the Virtual Machine page, click **Create**, and then select **Virtual machine**.\n\n![attachments/5-VM_Create.png](attachments/5-VM_Create.png)\n\n3.3 Fill out the following information:\n- Subscription - Select your current and active subscription\n- Resource Group - Select the resource group previously made in Step 1: **\"Testing-RG\"**\n- Virtual machine name - For this lab, we will name our VM:  **\"Linux-VM\"**\n- Region - Select your current region. For this lab, we will select **\"(US) East US\"**\n- Availablity Zone - Select **\"Zone 3\"**\n- Image - Select **\"Ubuntu Server 24.04 LTS - x64 Gen2\"**\n- Size - Select **\"Standard_D2s_v3 - 2vcpus, 8GiB memory ($70.08/month)\"**\n\n![attachments/linux-vm-settings.png](attachments/linux-vm-settings.png)\n\nCreate your **Administrator account**.\n\n- Select **Password** option for **Authentication Type**\n- For this lab, we will use **labuser** as the username and **Cyberlab123!** as the password.\n\nClick **Next: Disks\u003e**, and then **Next: Networking \u003e**\n\n![attachments/linux-acc-settings.png](attachments/linux-acc-settings.png)\n\n3.4 For our Virtual Network, we will be selecting the virtual network that we created when creating our Windows 11 virtual machine: **Lab-VNet**\n\n![attachments/linux-vnet.png](attachments/linux-vnet.png)\n\nClick **Review + Create** to proceed  \n\n![attachments/10-review-create.png](attachments/10-review-create.png)\n\n3.5 Confirm that **Validation passed** for your virtual machine.\n\nReview the the information you inputted, ensuring everything is correct.\n\nClick **Create** once more to initialize deployment of your virtual machine.\n\n![attachments/create-vm2.png](attachments/create-vm2.png)\n\n**A Linux Ubuntu Virtual Machine has now successfully been created** 👍\n\n## Login using RDP and Installing Wireshark\n\n### Step 1: Use Remote Desktop to connect to your Windows 11 Virtual Machine\n\n1.1 On your Virtual Machine page within Azure, you will be able to see the designated Public IP Address for each virtual machine created.\n\nUse the Windows 11 Virtual Machine's IP address to log in through Remote Desktop\n\n![attachments/windows-ip-address.png](attachments/windows-ip-address.png)\n\n![attachments/rdp.png](attachments/rdp.png)\n\n1.2 A small windows security prompt will ask you to enter your credentials to log into the virtual machine\n\n- We will use the username and password that we made when creating the virtual machines **(labuser/Cyberlab123!)**\n\n![attachments/windows-credentials.PNG](attachments/windows-credentials.PNG)\n\nAnother windows prompt will appear, click **Yes** to proceed\n\n![attachments/rdp2.png](attachments/rdp2.png)\n\nPower on the Windows 11 virtual machine and proceed with the setup steps until you reach the Windows Desktop.\n\n![attachments/window-desktop.PNG](attachments/window-desktop.PNG)\n\n\n### Step 2: Installing Wireshark\n\n2.1 Open Microsoft Edge and navigate to https://www.wireshark.org/. Download the installer labeled Windows x64 Installer.\n\n![attachments/wireshark.png](attachments/wireshark.png)\n\n![attachments/wireshark2.png](attachments/wireshark2.png)\n\n2.2 Run the Wireshark installer and proceed through the installation by clicking 'Next' at each step to complete the setup\n\n![attachments/wireshark2.png](attachments/wireshark3.png)\n\nOnce installation is complete, click **Finish**\n\n![attachments/wireshark16.png](attachments/wireshark16.png)\n\n2.3  Open up Wireshark. Once the application is running, performing the following steps:\n- Highlight **Ethernet**\n- Click the blue fin at the top left corner to start **capturing packets**\n\n![attachments/wireshark-open1.png](attachments/wireshark-open1.png)\n\nOnce you have started capturing packets, you will notice a stream of entries in Wireshark. This is ongoing network traffic that is happening on the backend of your virtual machine. Your network protocol analyzer (Wireshark) is capturing all incoming and outgoing packets, and from here we are able to observe various types of network traffic and protocols in real time.\n\n![attachments/wireshark-open2.png](attachments/wireshark-open2.png)\n\n## Observing ICMP Traffic\n\nICMP (Internet Control Message Protocol) is a network protocol used for sending error messages and operational information. ICMP is the underlying protocol that makes the **ping** command functional. In this section, we will observe ICMP traffic through the following examples:\n- [Between our Windows 11 and Linux Ubuntu virtual machines](#example-1-observing-icmp-traffic-between-virtual-machines)\n- [Initiating a continuous ping and configuring firewall rules (e.g., Network Security Groups)](#example-2-initiating-a-continuous-ping-and-configuring-firewall-rules-eg-network-security-groups)\n\n### Example 1: Observing ICMP traffic between virtual machines\n\nTo start, we will obtain the private IP address of our Linux Ubuntu virtual machine.\n\nHead back to the virtual machine page on Azure, and click on **Linux VM**. On the right side of the page, under **Networking** the private IP address of the virtual machine should be displayed. This is the IP address that we will **ping** within our Windows 11 virtual machine.\n\n![attachments/linux-ip.png](attachments/linux-ip.png)\n\nOn our Windows 11 virtual machine, filter out ICMP traffic on Wireshark by typing ICMP within the search/filter bar. This will result in only ICMP traffic being displayed.\n\n![attachments/icmp.png](attachments/icmp.png)\n\nIn the windows search bar, search for and open the application, **Windows Powershell**,\n\nFrom here, we will attempt to ping the Linux virtual machine using its private IP address to make contact.\n\nType the following: **ping 10.0.0.5**, then click Enter\n\n![attachments/ping.png](attachments/ping.png)\n\nA successful ping has been made, as the Linux virtual machine is responding back to the requests from our Windows virtual machine\n\n![attachments/ping2.png](attachments/ping2.png)\n\nNavigate back to Wireshark, and you will be able to see the ICMP traffic that occurred between both virtual machines.\n\n![attachments/icmp-ping.png](attachments/icmp-ping.png)\n\nYou'll notice that **Wireshark displays 8 packet entries**, whereas **Windows PowerShell shows only 4**.\n\nThis is because:\n\n- **Wireshark** captures **both the request and reply packets** of the ping command.\n- **PowerShell** only displays the **replies** received from the Linux virtual machine.\n\nAs a result, each ping generates **two packets** (one request, one reply), and Wireshark provides a more detailed view of the full network exchange.\n\nBy analyzing these packets in Wireshark, we can clearly see the exchange of ICMP traffic between the two virtual machines.\n\n### Example 2: Initiating a continuous ping and configuring firewall rules (e.g., Network Security Groups)\n\nWe will initiate a perpetual ping from the Windows 11 virtual machine to the Linux Ubuntu virtual machine.\n\nTo perform this, type the following into Windows Powershell, then run the command:\n\n- **ping  10.0.0.5 -t**\n\n_NOTE_: This is a continuation of the previous example, with the -t flag added to the ping command to create a continuous stream of ICMP requests between the Windows 11 and Linux Ubuntu virtual machines\n\n![attachments/ping-t2.png](attachments/ping-t2.png)\n\nBack on Wireshark, the same activity is reflected. You will see multiple request and reply packets being captured between both virtual machines.\n\n![attachments/ping-t3.png](attachments/ping-t3.png)\n\n**Now we are going to open up the Network Security Group for the Linux Ubuntu virtual machine, and disable incoming ICMP traffic. After, we will observe the network traffic in Wiresharkto see the resulting behavior.**\n\nHead over to our Azure portal, and open up Linux-VM\n\nNavigate to **Network settings** and under **Network Security Group**, click **Linux-VM-nsg**\n\n![attachments/linux-nsg.png](attachments/linux-nsg.png)\n_NOTE_: A Network Security Group (NSG) is a virtual firewall used in Microsoft Azure to control inbound and outbound network traffic to and from Azure resources, such as virtual machines (VMs), subnets, or network interfaces.\n\nOn the left hand side, click **Settings \u003e Inbound security rules**, then click **Add**\n\n![attachments/linux-nsg2.png](attachments/linux-nsg2.png)\n\nHere we will create an inbound security rule preventing ICMP traffic from going into our Windows virtual machine. We will observe the activity that occurs afterwards.\n\nFill in the following information:\n\n- Destination port ranges - * (just an asterisk)\n- Protocol - **ICMPv4** (ICMP protocol)\n- Action - **Deny** (Will prevent incoming ICMP traffic)\n- Priority - **290** (Will be highest priority within our security rules)\n\nThen click **Add** to create rule\n\n![attachments/linux-nsg3.png](attachments/linux-nsg3.png)\n\nBack on our Windows virtual machine, our perpetual ping within Windows Powershell will start to time out. This is because the inbound security rule that we created has started taking affect, and is blocking the ICMP request packets coming from the Windows virtual machine to the Linux virtual machine.\n\nThis results in the Windows virtual machine not being able to receive a reply packet, thus making our Powershell time out.\n\n![attachments/linux-nsg4.png](attachments/linux-nsg4.png)\n\nThis is also reflected on Wireshark as well. No responses will be found as the request packets from the Windows virtual machine aren't going through.\n\n![attachments/linux-nsg5.png](attachments/linux-nsg5.png)\n\nWith Network Security Groups, we are able to create rules to allow/deny certain network protocols for both inbound and outbound traffic\n\nLet's go ahead and remove the inbound security rule we made. Go back into the Linux virtual machine's network security group in Azure and delete the inbound security rule by performing the following:\n\n- Check security rule\n- Click trash icon\n- Click Yes to delete security rule\n\n![attachments/linux-nsg6.png](attachments/linux-nsg6.png)\n\nBack on our Windows virtual machine, our perpetual ping within Windows Powershell will continue again, as the security rule has been removed. Request and reply packets, and ICMP traffic can now communicate between virtual machines.\n\n![attachments/linux-nsg7.png](attachments/linux-nsg7.png)\n\nThe ICMP traffic on Wireshark is now up and running as well.\n\n![attachments/linux-nsg8.png](attachments/linux-nsg8.png)\n\nGo ahead and stop the perpetual ping by pressing **CRTL + C**\n\n![attachments/control-c.png](attachments/control-c.png)\n\nBy performing these examples, we’ve demonstrated how ICMP traffic operates within a network and how tools like Wireshark can be used to monitor it. We also explored how firewall rules, such as those configured in Network Security Groups and how it directly impact the flow of network traffic. This provides valuable insight into both connectivity diagnostics and network security control.\n\n## Observing SSH Traffic\n\nSSH (Secure Shell) is a network protocol used to securely connect one computer to another over an unsecured network. It is used for secure remote access and system administration over a network.\n\nSSH also allows users to remotely log in, run commands, and manage systems, all while encrypting the connection to protect data from interception. In this section, we will observe SSH traffic through the following example:\n\n- [Observing SSH traffic between virtual machines](#observing-ssh-traffic-between-virtual-machines)\n\n### Observing SSH traffic between virtual machines\n\nTo start, make sure the following has been performed:\n\n- Both virtual machines are turned on (Windows and Linux)\n- Log in to your Windows virtual machine\n- Start up Wireshark\n\nIn Wireshark, start a packet capture up and filter for **SSH** traffic only.\n\n![attachments/ssh.png](attachments/ssh.png)\n\nFrom your Windows 10 virtual machine, open up Windows Powershell. We will now **\"SSH into\"** our Linux Ubuntu virtual machine via its private IP address.\n\nType in the following: _ssh labuser@10.0.0.5_, then click Enter.\n\n![attachments/ssh1.png](attachments/ssh1.png)\n\nYou will be prompted to continue connecting to the Linux virtual machine.\n\nPerform the following:\n\n- Type **yes**, then click enter\n- After, type the Linux virtual machine's password: **Cyberlab123!**, then click enter\n\n![attachments/ssh2.png](attachments/ssh2.png)\n\n_NOTE_: When you tpye your password here, nothing will appear. This is for security purposes. Rest assured text will still be entered.\n\nAs you can see in Windows Powershell, the prompt changed to **labuser@Linux-VM**, which means we are now securely connected to our Linux virtual machine through SSH.\n\n![attachments/ssh4.png](attachments/ssh4.png)\n\nBack in Wireshark, SSH traffic is reflected from our activity in Windows Powershell\n\nAny activity performed in Windows PowerShell while connected via SSH will generate corresponding traffic that can be observed in Wireshark. This includes everything from executing commands to simply typing in the command-line interface\n\n![attachments/ssh3.png](attachments/ssh3.png)\n\nTo show that we are connected to the Linux Ubuntu virtual machine, we can type some commands to test it out.\n\nType **hostname**, then click enter.\n\nHere, it will prompt the following message: **linux-vm**. Even though we are on our Windows virtual machine, we are remotely connected to our Linux virtual machine via SSH. This allows us to control and execute commands from our Windows command line tool.\n\n![attachments/hostname.PNG](attachments/hostname.PNG)\n\nType **pwd**, then click enter.\n\nHere, it will prompt the following message: **/home/labuser**. This example shows that we are in the working directory of **/home/labuser** which is in our Linux virtual machine.\n\n![attachments/pwd1.PNG](attachments/pwd1.PNG)\n\nExit the SSH connection by typing **exit** and clicking Enter\n\n![attachments/exit1.PNG](attachments/exit1.PNG)\n\nThis example showed how SSH traffic works on a network and how Wireshark can be used to observe it. We also learned how SSH securely connects to remote systems, giving us a better understanding of encrypted communication\n\n## Observing DHCP traffic\n\nDHCP (Dynamic Host Configuration Protocol) is a network protocol used automatically assign an IP address and other network settings to a device on the network. In this section, we will observe SSH traffic through the following example:\n\n- [Requesting a new IP Address via DHCP](#requesting-a-new-ip-address-via-dhcp)\n\n### Requesting a new IP Address via DHCP\n\nTo start, make sure the following has been performed:\n\n- Log in to your Windows virtual machine\n- Start up Wireshark\n\nIn Wireshark, start a packet capture up and filter for **DHCP** traffic only\n\n![attachments/dhcp.png](attachments/dhcp.png)\n\nOpen up an instance of Notepad and type in the following\n\n```\nipconfig /release\nipconfig /renew\n```\n\nSave the notepad document by performing the following steps\n\n- File type: Enter **c:\\programdata**\n- File name: **dhcp.bat**\n- File type: **All Files**\n\n![attachments/notepad-save.png](attachments/notepad-save.png)\n\nRun Windows Powershell as Administrator by right clicking the application and clicking \"Run as Administrator\"\n\n![attachments/run-as-admin.png](attachments/run-as-admin.png)\n\nRun the following command:\n\n```\ncd c:\\programdata\n```\n\n![attachments/programdata.png](attachments/programdata.png)\n\nand then:\n```\n.\\dhcp.bat\n```\n\n![attachments/dhcp-bat.png](attachments/dhcp-bat.png)\n\nOnce the previous command is run, the Windows virtual machine releases its current IP address and requests a new one from the DHCP server through the DHCP handshake process.\n\nIn Wireshark, the following DHCP packets will appear, each representing a step in the DHCP handshake process.\n\n![attachments/dora.png](attachments/dora.png)\n\nThis is the standard 4 step process known as DORA that is used by DHCP to assign an IP address to a client. The steps of the DHCP handshake are shown in the table below:\n\n| Step | Protocol Message  | Description                                                                                    |\n| ---- | ----------------- | ---------------------------------------------------------------------------------------------- |\n| 1️⃣  | **DHCP Discover** | The client (source: `0.0.0.0`) broadcasts a request to find a DHCP server.                     |\n| 2️⃣  | **DHCP Offer**    | A DHCP server (source: `168.63.129.16`) responds with an IP address offer and network details. |\n| 3️⃣  | **DHCP Request**  | The client requests to use the offered IP address by sending a DHCP Request message.           |\n| 4️⃣  | **DHCP ACK**      | The server acknowledges the request and officially assigns the IP to the client.               |\n\nHere is another representation on how the DHCP handshake works. Again, this is the standard 4 step process known as DORA that is used by DHCP to assign an IP address to a client.\n\n![attachments/handshake.PNG](attachments/handshake.PNG)\n\nThis example showed how DHCP works on a network and how Wireshark helps us see the traffic involved. We also learned about the DORA process and how it’s used during the DHCP handshake to assign an IP address to a device.\n\n## Observing DNS Traffic\n\nDNS (Domain Name System) is a network protocol that translates human-readable domain names into IP addresses that computers use to communicate with each other over the internet or a network. In this section, we will observe DNS traffic through the following example:\n\n- [nslookup within Windows Powershell](#nslookup-within-Windows-Powershell)\n\n### nslookup within Windows Powershell\n\nTo start, make sure the following has been performed:\n\n- Log in to your Windows virtual machine\n- Start up Wireshark\n- Start up Windows Powershell\n\nIn Wireshark, start a packet capture up and filter for **DNS** traffic only.\n\n![attachments/dns2.png](attachments/dns2.png)\n\nWe will be using the command **nslookup** for this DNS activity. **nslookup** is a command line tool used to query DNS to obtain the domain name or IP address mapping information.\n\nIn Windows Powershell, we will type in the following command, then click enter\n\n_NOTE_: Any public website or domain can be inserted here.\n\n```\nnslookup disney.com\n```\n\nWhat came back was the public IP Address of the domain that we inputted into our command line interface. In this case, the IP address for **disney.com** is **130.211.198.204**\n\n![attachments/dns.png](attachments/dns.png)\n\nBack in Wireshark, DNS traffic is reflected from our activity in Windows Powershell\n\n![attachments/dns3.png](attachments/dns3.png)\n\nIn this lab, we used DNS to resolve domain names to IP addresses, demonstrating how devices rely on DNS to locate and connect to remote servers. Tools like nslookup and Wireshark helped us observe and analyze the DNS query and response process in real time.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkimleeheng%2Fazure-network-protocols","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkimleeheng%2Fazure-network-protocols","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkimleeheng%2Fazure-network-protocols/lists"}