Build a Small Security Lab Network and Learn How Traffic Actually Moves
A Zero Trust Threads Foundations Guide to Networking and Traffic Analysis
A single server is a great place to learn system administration, but cybersecurity is fundamentally about communication. Attacks do not happen in a vacuum; they move across networks. To understand how malicious traffic operates, you first need to see what normal traffic looks like.
In this final project of the Home Lab series, we are going to expand your lab from a single standalone machine into a functioning network. You will spin up a second Virtual Machine, establish a connection between the two, and use a packet sniffer to actually watch the data travel across the wire.
Step 1: Deploying the Second Machine
You already know how to build an Ubuntu Server from Article 17. Repeat that exact process to create a second VM.
To keep things organized, name this new machine Ubuntu-Client-01 in your hypervisor. Go through the installation process just as before, ensuring you create a user and install the OpenSSH server.
Once the installation is complete and you are logged in, run the standard updates:
sudo apt update && sudo apt upgrade -y
ou now have two distinct servers running simultaneously on your Host machine.
Step 2: Discovering Your IP Addresses
For these two machines to communicate, they need to know each other's addresses. By default, your hypervisor assigns a local, internal IP address to every VM it runs.
Open two separate terminal windows on your Host computer—one SSH'd into your original server (Ubuntu-Server-01) and one SSH'd into your new client (Ubuntu-Client-01).
On both machines, run the following command to check their network interfaces:
ip a
Look for the interface that has an inet address (often starting with 10.0.x.x or 192.168.x.x).
Write down the IP address for Server-01 (e.g., 192.168.64.4).
Write down the IP address for Client-01 (e.g., 192.168.64.5).
Step 3: Testing Connectivity (Ping)
We need to verify that a network path exists between the two machines. We do this using ping, a network utility that sends a small packet of data (an ICMP Echo Request) to a target and waits for a reply.
From your Client-01 terminal, type:
ping <IP\_Address\_of\_Server-01>
You should see a continuous output of replies indicating the time it took for the packet to make the round trip. Press Ctrl+C to stop the ping. If you see replies, your virtual network is functioning perfectly.
Step 4: Making the Invisible Visible (tcpdump)
Seeing the ping command succeed is helpful, but it abstracts away the actual mechanics of the network. To see the raw packets moving back and forth, we use a tool called tcpdump.
Go to your Server-01 terminal and install tcpdump:
sudo apt install tcpdump -y
Now, tell tcpdump to listen to the network interface and filter only for ICMP (ping) traffic:
sudo tcpdump -i any icmp
The terminal will pause and wait. It is now actively "sniffing" the virtual network wire.
Leave that running, and go back to your Client-01 terminal. Run the ping command again:
ping <IP\_Address\_of\_Server-01>
Look at your Server-01 window. You will see a real-time stream of data representing the exact moment the request arrives from the Client's IP address, and the exact moment your Server sends the reply back.
This is the foundational skill of network defense. When a security analyst looks for evidence of an attacker scanning their network, they are looking at packet captures just like this one. Press Ctrl+C on both machines to stop the capture and the ping.
Step 5: Observing Web Traffic (Ports and Services)
Let's look at one more example using the Nginx web server you built in Article 19.
Start tcpdump on Server-01 again, but this time, tell it to listen for traffic on Port 80, the standard port for unencrypted HTTP web traffic:
sudo tcpdump -i any port 80
Now, from your Client-01 terminal, we will use a command-line tool called curl to request the web page from the server, just like a web browser would:
curl http://<IP\_Address\_of\_Server-01>
Your Client terminal will instantly display the HTML code of the Nginx welcome page. But more importantly, look at your Server terminal. You will see the complex multi-step "TCP Handshake" as the Client requests a connection, the Server acknowledges it, the data transfers, and the connection closes.
The Foundation is Set
Over the course of these five articles, you have moved from understanding the theory of virtualization to actively analyzing network packets moving between multiple Linux servers.
You haven't just read about cybersecurity—you have built a functional environment to practice it. Keep this lab running. As you read tutorials, watch videos, or learn about new vulnerabilities, you now have a safe, private testing ground to replicate them yourself.
