# Build a Small Security Lab Network and Learn How Traffic Actually Moves

A single server is a great place to learn system administration, but cybersecurity is fundamentally about communication. Attacks do not happen in a vacuum; they move across networks. To understand how malicious traffic operates, you first need to see what normal traffic looks like.

In this final project of the Home Lab series, we are going to expand your lab from a single standalone machine into a functioning network. You will spin up a second Virtual Machine, establish a connection between the two, and use a packet sniffer to actually watch the data travel across the wire.

### **Step 1: Deploying the Second Machine**

You already know how to build an Ubuntu Server from Article 17. Repeat that exact process to create a second VM.

To keep things organized, name this new machine `Ubuntu-Client-01` in your hypervisor. Go through the installation process just as before, ensuring you create a user and install the OpenSSH server.

Once the installation is complete and you are logged in, run the standard updates:

```bash
sudo apt update && sudo apt upgrade -y
```

ou now have two distinct servers running simultaneously on your Host machine.

### **Step 2: Discovering Your IP Addresses**

For these two machines to communicate, they need to know each other's addresses. By default, your hypervisor assigns a local, internal IP address to every VM it runs.

Open two separate terminal windows on your Host computer—one SSH'd into your original server (`Ubuntu-Server-01`) and one SSH'd into your new client (`Ubuntu-Client-01`).

On both machines, run the following command to check their network interfaces:

```bash
ip a
```

Look for the interface that has an inet address (often starting with 10.0.x.x or 192.168.x.x).

Write down the IP address for Server-01 (e.g., 192.168.64.4).

Write down the IP address for Client-01 (e.g., 192.168.64.5).

### **Step 3: Testing Connectivity (Ping)**

We need to verify that a network path exists between the two machines. We do this using ping, a network utility that sends a small packet of data (an ICMP Echo Request) to a target and waits for a reply.

From your Client-01 terminal, type:

```bash
ping <IP\_Address\_of\_Server-01>
```

You should see a continuous output of replies indicating the time it took for the packet to make the round trip. Press Ctrl+C to stop the ping. If you see replies, your virtual network is functioning perfectly.

### **Step 4: Making the Invisible Visible (tcpdump)**

Seeing the ping command succeed is helpful, but it abstracts away the actual mechanics of the network. To see the raw packets moving back and forth, we use a tool called tcpdump.

Go to your Server-01 terminal and install tcpdump:

```bash
sudo apt install tcpdump -y
```

Now, tell tcpdump to listen to the network interface and filter only for ICMP (ping) traffic:

```bash
sudo tcpdump -i any icmp
```

The terminal will pause and wait. It is now actively "sniffing" the virtual network wire.

Leave that running, and go back to your Client-01 terminal. Run the ping command again:

```bash
ping <IP\_Address\_of\_Server-01>
```

Look at your Server-01 window. You will see a real-time stream of data representing the exact moment the request arrives from the Client's IP address, and the exact moment your Server sends the reply back.

This is the foundational skill of network defense. When a security analyst looks for evidence of an attacker scanning their network, they are looking at packet captures just like this one. Press Ctrl+C on both machines to stop the capture and the ping.

### **Step 5: Observing Web Traffic (Ports and Services)**

Let's look at one more example using the Nginx web server you built in Article 19.

Start tcpdump on Server-01 again, but this time, tell it to listen for traffic on Port 80, the standard port for unencrypted HTTP web traffic:

```bash
sudo tcpdump -i any port 80
```

Now, from your Client-01 terminal, we will use a command-line tool called curl to request the web page from the server, just like a web browser would:

```bash
curl http://<IP\_Address\_of\_Server-01>
```

Your Client terminal will instantly display the HTML code of the Nginx welcome page. But more importantly, look at your Server terminal. You will see the complex multi-step "TCP Handshake" as the Client requests a connection, the Server acknowledges it, the data transfers, and the connection closes.

### **The Foundation is Set**

Over the course of these five articles, you have moved from understanding the theory of virtualization to actively analyzing network packets moving between multiple Linux servers.

You haven't just read about cybersecurity—you have built a functional environment to practice it. Keep this lab running. As you read tutorials, watch videos, or learn about new vulnerabilities, you now have a safe, private testing ground to replicate them yourself.

### **References & Primary Documentation:**

*   [tcpdump Official Manual](https://www.tcpdump.org/manpages/tcpdump.1.html)
    
*   [Understanding the TCP/IP Model (Cisco)](https://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13769-5.html)