Azure-Compute-and-Networking

This Azure Compute and Networking Project shows the examination of network traffic analysis between two Azure Virtual Machines using Wireshark and experiment with Network Security Groups

Environments and Technologies Used

• Microsoft Azure (Virtual Machines/Compute)
• Remote Desktop
• Various Command-Line Tools
• Various Network Protocols (SSH, RDH, DNS, HTTP/S, ICMP)
• Wireshark (Protocol Analyzer)

Operating Systems Used

• Windows 10 (21H2)
• Ubuntu Server 20.04

Actions and Observations

Creating The Resources

I created a Resource Group in Microsoft Azure. Moreover, I set up a Windows 10 Virtual Machine and a Linux (Ubuntu) Virtual Machine. While configuring the Windows 10 VM, I allowed it to create a Virtual Network (Vnet) and Subnet. Lastly, I observed the Virtual Machine within the network using Network Watcher.

Observe ICMP Traffic

After creating the Virtual Machines, I used Remote Desktop to connect to the Windows 10 VM. I installed Wireshark and filtered for ICMP traffic. By pinging the private IP address of the Ubuntu VM within the Windows 10 VM, I observed ping requests and replies in Wireshark. Then, I pinged www.google.com and examined the traffic.

I initiated a perpetual ping between the Windows 10 and Ubuntu VMs. Disrupting the inbound ICMP traffic in Azure, I observed the interruption in communication between the VMs. Finally, I stopped the ping at the end of this experiment.

Observe SSH Traffic

Next, I securely accessed the Ubuntu VM via SSH, enabling me to closely monitor SSH traffic between the Windows 10 VM and the Ubuntu VM. Furthermore, I executed various Linux commands to observe the resulting SSH traffic spikes in WireShark.

Observe DHCP Traffic

Next, I monitored DHCP traffic and made an attempt to assign a new IP address. I closely observed the DHCP traffic within WireShark to analyze the results.

Observe DNS Traffic

Next, I filtered for DNS traffic and used the nslookup command in PowerShell to examine DNS queries. I specifically observed the IP addresses associated with Google. This allowed me to closely observe the DNS traffic displayed in WireShark.

Observe RDP Traffic

In WireShark, I applied a filter for RDP traffic only (tcp.port == 3389) to witness the constant live streaming of the RDP protocol between two computers.