HackBlue

Labs / Network defense

Packet flow puzzle

Put the packets of one HTTPS page load in order, from the DNS question to the first encrypted byte, and follow the addresses through a NAT router.

  • Interactive lab
  • Beginner
  • 5 steps
  • 0 of 5 solved

Goal

A laptop at 192.168.1.20 opens https://www.contoso.example. Its home router does NAT, so on the internet side the laptop appears as 198.51.100.7.

The eight packets below are out of order. Move them until they match what a capture would show, then switch views to see how the router rewrites addresses.

Laptop192.168.1.20
Router (NAT)192.168.1.1198.51.100.7
InternetDNS 192.0.2.53Web 203.0.113.80
Capture view
  1. TCP
    TCP [SYN, ACK] seq=0 ack=1203.0.113.80:443 → 192.168.1.20:51514
  2. TLS
    TLS 1.3 ClientHello, SNI=www.contoso.example192.168.1.20:51514 → 203.0.113.80:443
  3. UDP
    DNS response: www.contoso.example A 203.0.113.80192.0.2.53:53 → 192.168.1.20:53001
  4. TLS
    TLS Application Data (the encrypted HTTP GET /)192.168.1.20:51514 → 203.0.113.80:443
  5. TCP
    TCP [SYN] seq=0192.168.1.20:51514 → 203.0.113.80:443
  6. UDP
    DNS query: A www.contoso.example?192.168.1.20:53001 → 192.0.2.53:53
  7. TLS
    TLS 1.3 ServerHello, then encrypted extensions and certificate203.0.113.80:443 → 192.168.1.20:51514
  8. TCP
    TCP [ACK] seq=1 ack=1192.168.1.20:51514 → 203.0.113.80:443

Steps

  1. 01Put the eight packets in the order they cross the wire.

    Do this in the workbench above. This step completes itself when the condition is met.

  2. 02What source IP address does the web server see on the SYN?

  3. 03The SYN-ACK arrives at the router addressed to 198.51.100.7:40122. Where does the router send it?

  4. 04Which two TCP flags are set on the server’s first reply?

  5. 05With TLS 1.3, which packet still shows the site name to anyone watching the network?