Session 2, HTTP Traffic Analysis & Flood Simulation (LAB ONLY)

Objective: Run a simple HTTP server in Kali, capture HTTP traffic in Windows, and distinguish normal patterns from an ICMP flood.

LAB ONLY: Flood only in Host-Only/isolated network.

Prerequisites & Topology Same topology as Session 1. Kali = HTTP server 10.37.129.3, Windows = client 10.37.129.2.

Preparation Kali has Python 3:

Windows/Mac os is ready to run Wireshark.

Steps

A. Run an HTTP server in Kali

B. Access from Windows & capture Windows (Wireshark): select Host-Only interface → Start.

Windows (PowerShell/Browser)/ Mac os (Terminal):

powershell/terminal

# or open in browser

Wireshark display filter:

Check: GET / HTTP/1.1, 200 OK, headers (Host, User-Agent, Content-Type).

C. ICMP flood simulation (optional) Kali (new terminal):

alternative (lighter):

Wireshark: stop after a few seconds → Statistics → I/O Graph; compare pps before/during flood. Filter: icmp.

Verification / Results

1. HTTP normal: burst + TCP handshake + request/response
2. ICMP flood: continuous, high pps, no handshake

Cleanup

1. Ctrl+C (hping3/ping -f)
2. Ctrl+C HTTP server
3. Save pcap

Troubleshooting

1. hping3 requires sudo
2. No 8080 visible? Check the filter and the destination IP