Public WiFi Risks & Network Monitoring: Protection & Visibility

Tutorial 5: Public WiFi Risks & Network Monitoring

Overview

Public WiFi is everywhere — cafes, airports, hotels, libraries — but it comes with significant security risks. Network Monitoring, on the other hand, is the practice of continuously observing a network to detect issues, attacks, and anomalies. This tutorial covers both topics to help you stay safe on public networks and keep your own network healthy.

Table of Contents

• 1. Why Public WiFi is Dangerous
• 2. Common Public WiFi Attacks
  • 2.1 Man-in-the-Middle (MITM)
  • 2.2 Evil Twin Attack
  • 2.3 Packet Sniffing
  • 2.4 Rogue Access Point
  • 2.5 Sidejacking (Session Hijacking)
  • 2.6 DNS Spoofing
• 3. Real-World Example: Coffee Shop Attack
• 4. How to Protect Yourself on Public WiFi
• 5. What About "Public WiFi with Password"?
• 6. What is Network Monitoring?
• 7. Types of Network Monitoring
• 8. Key Network Monitoring Metrics
• 9. Popular Network Monitoring Tools
• 10. SNMP (Simple Network Management Protocol)
• 11. Alerting & Thresholds
• 12. Monitoring for Security Threats
• Summary
• Practical Exercises

Public WiFi Risks

1. Why Public WiFi is Dangerous

Public WiFi networks are typically open or shared, meaning:

• No encryption (or weak encryption)
• Shared passwords visible to many people
• Admin control by unknown/untrusted parties
• Many devices connected simultaneously — including attackers

The Threat Landscape

[Attacker Laptop]      [Victim]           [Coffee Shop Router]
      │                   │                       │
      ├─ Sniff Packets ──→│                       │
      ├─ MITM Attack ────→│                       │
      ├─ Evil Twin ───────┤ (fake AP)             │
      └─ Malvertising ────┤                       │

2. Common Public WiFi Attacks

Attackers use a variety of techniques to exploit public WiFi users — from intercepting traffic to setting up fake networks that trick victims into connecting.

2.1 Man-in-the-Middle (MITM)

The attacker intercepts traffic between the victim and the internet.

[Victim] ←→ [Attacker] ←→ [Internet]

Tools used: Bettercap, Ettercap, mitmproxy

2.2 Evil Twin Attack

The attacker sets up a fake access point with the same SSID as the legitimate one.

Victim sees: "CoffeeShop_FreeWiFi" (x2)
                │                │
          Legitimate AP      Evil Twin (attacker)

How to spot:

• Stronger signal than expected
• Multiple APs with the same name
• No password when the real one requires it

2.3 Packet Sniffing

Capturing unencrypted data packets traveling through the network.

# Using tcpdump to capture HTTP traffic
sudo tcpdump -i wlan0 port 80 -A

# Using Wireshark (GUI)
# Capture → Interfaces → Select WiFi interface

What attackers can see:

• HTTP websites and form data
• Unencrypted emails and messaging
• FTP credentials
• DNS queries
• Device MAC addresses

2.4 Rogue Access Point

An unauthorized AP connected to the corporate network — creates a backdoor.

2.5 Sidejacking (Session Hijacking)

Stealing session cookies from HTTP traffic to impersonate a logged-in user.

[Victim logs into Facebook on public WiFi]
                    ↓
[Attacker captures session cookie via Firesheep/hijacking tool]
                    ↓
[Attacker loads the cookie and gains access to victim's account]

2.6 DNS Spoofing

Redirecting the victim to a fake website by corrupting DNS responses.

Victim types: facebook.com
DNS should resolve to: 31.13.71.36
DNS resolves to: 192.168.1.100 (attacker's phishing site)

3. Real-World Example: Coffee Shop Attack

1. Attacker arrives at coffee shop
2. Sets up Evil Twin AP ("CoffeeShop_Free")
3. Starts Bettercap for MITM + SSL stripping
4. Victim connects to the fake AP
5. Attacker captures:
   - Gmail session cookies
   - Facebook access tokens
   - HTTP form submissions
6. Attacker uses cookies to access victim's accounts

4. How to Protect Yourself on Public WiFi

While public WiFi has many risks, you can protect yourself by following a set of essential practices — starting with using a VPN and HTTPS everywhere.

Essential Protections

The "Hotel WiFi" Security Flow

1. ❌ Don't connect immediately
2. ✅ Connect to official hotel network (ask at front desk)
3. ✅ Enable VPN FIRST
4. ✅ Browse normally (through VPN tunnel)
5. ✅ Use 2FA for sensitive accounts
6. ✅ "Forget This Network" after checkout
7. ✅ Change password later at home

Protection Commands

# Windows: Turn off network discovery
netsh advfirewall firewall set rule group="Network Discovery" new enable=No

# macOS: Disable sharing
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.smbd.plist

# Linux: Use iptables to block everything except VPN
iptables -A OUTPUT -j DROP
iptables -A INPUT -j DROP
# Then start VPN (which adds its own rules)

Quick Checklist

• VPN is running BEFORE connecting to WiFi
• HTTPS Everywhere extension is enabled
• File sharing is disabled
• Firewall is active
• Auto-connect is OFF
• Two-factor authentication is enabled on key accounts

5. What About "Public WiFi with Password"?

A shared password (printed on a coffee shop receipt) provides:

• ❌ No encryption (same encryption as open network)
• ❌ No authentication (password is shared with everyone)
• ❌ No accountability (anyone can connect)
• ✅ Slight deterrent against casual users

Bottom line: A password on public WiFi does NOT make it secure. Always use a VPN.

Network Monitoring

6. What is Network Monitoring?

Network monitoring is the systematic observation of a computer network to detect slow or failing components, security breaches, bandwidth issues, and other problems. It provides visibility into everything happening on your network.

Why Monitor?

• Detect attacks — Identify breaches early
• Troubleshoot issues — Find the root cause of slowdowns
• Capacity planning — Know when to upgrade
• Compliance — Meet regulatory requirements (PCI DSS, HIPAA, GDPR)
• Baseline — Understand "normal" to spot "abnormal"

7. Types of Network Monitoring

Network monitoring can be broken down into several categories — each focusing on a different aspect of network health and security.

7.1 Bandwidth Monitoring

Tracks network utilization and traffic volume.

• Metrics: Mbps, GB used, top talkers
• Tools: PRTG, Zabbix, MRTG

7.2 Device Monitoring

Tracks the health of network devices.

• Metrics: CPU, memory, uptime, interface errors
• Protocol: SNMP (Simple Network Management Protocol)

7.3 Traffic Analysis

Analyzes the types of traffic flowing through the network.

• Protocols used: HTTP, DNS, SSH, etc.
• Top destinations: Which IPs are most communicated with
• Tools: Wireshark, ntopng, NetFlow

7.4 Log Monitoring

Centralizes and analyzes logs from all network devices.

• Syslog — Standard log format
• SIEM — Security Information and Event Management
• Tools: Splunk, ELK Stack, Graylog

7.5 Security Monitoring

Focuses specifically on security threats.

• Tools: IDS/IPS (covered in Tutorial 3), SIEM, threat intelligence

8. Key Network Monitoring Metrics

These metrics provide a quantitative view of network health — tracking them over time helps you spot anomalies and plan capacity upgrades.

9. Popular Network Monitoring Tools

From packet analyzers to full-stack monitoring suites — these tools give you visibility into every aspect of your network.

Quick Start: Wireshark for Security Monitoring

# Common display filters:
http.request                 # Show HTTP requests
tcp.port == 443             # Show HTTPS traffic
ip.addr == 192.168.1.100    # Traffic from/to a specific IP
dns                          # Show DNS queries
icmp                         # Show ping traffic
tcp.flags.syn == 1          # Show SYN packets (new connections)
http.request.method == POST # Show form submissions

Quick Start: Zabbix Configuration

# Install Zabbix agent on monitored device
sudo apt install zabbix-agent

# Configure agent (/etc/zabbix/zabbix_agentd.conf)
Server=192.168.1.10      # Zabbix server IP
ServerActive=192.168.1.10
Hostname=WebServer01

# Restart agent
sudo systemctl restart zabbix-agent

10. SNMP (Simple Network Management Protocol)

What is SNMP?

SNMP is a standard protocol for collecting and organizing information about managed devices on IP networks.

SNMP Versions

SNMP OIDs Example

# Query system information
snmpget -v3 -u monitor -l authPriv \
  -a SHA -A AuthPass123 -x AES -X PrivPass123 \
  192.168.1.1 1.3.6.1.2.1.1.1.0     # System Description

snmpwalk -v3 -u monitor -l authPriv \
  -a SHA -A AuthPass123 -x AES -X PrivPass123 \
  192.168.1.1 1.3.6.1.2.1.2.2.1.10  # Interface Traffic

11. Alerting & Thresholds

Alerts turn raw monitoring data into actionable notifications — but only if thresholds are set correctly to balance between noise and missed warnings.

Setting Up Alerts

Alert Response Flow

[Alert Triggered]
       ↓
[Acknowledged by Engineer]
       ↓
[Initial Assessment] → Is it critical? → [YES] → [Incident Response]
       ↓ NO                                    ↓
[Investigate] → [Root Cause Found] → [Resolve] → [Document]

12. Monitoring for Security Threats

Beyond performance metrics, network monitoring is essential for detecting security incidents — specific traffic patterns can indicate an active breach or malware infection.

What to Watch For

Setting Up a Simple Security Dashboard with Grafana

1. Data Source: Prometheus (metrics from exporters)
2. Dashboards:
   - Traffic volume (bits/sec)
   - Top source/destination IPs
   - Protocol distribution
   - Error rates
   - Unusual activity timeline
3. Alerts:
   - Anomaly detection thresholds
   - Notification via Slack/Email/PagerDuty

Practical Exercises

Exercise 1: Public WiFi Risk Assessment

Objective: Evaluate the security of a real public WiFi network (at a cafe, library, hotel, or airport).

⚠️ IMPORTANT: This exercise is for assessment only — do NOT attempt to intercept or attack other users' traffic. Only observe what's visible from your own device.

Network Reconnaissance (Passive):

# Windows: List nearby networks
netsh wlan show networks mode=bssid

# Linux/macOS: Scan nearby networks
sudo iw dev wlan0 scan | grep -E "SSID|freq|signal|RSN"

Connection Assessment: When you connect to a public WiFi network, assess these factors:

Protection Verification:

• ✅ Is your VPN on before browsing?
• ✅ Is HTTPS Everywhere active?
• ✅ Is file sharing disabled?
• ✅ Is auto-connect disabled for future sessions?

Report: Write a short report (3-5 sentences) on whether this public WiFi network is safe and what precautions you took.

Exercise 2: Build a Simple Network Monitor

Objective: Set up basic network monitoring on your own computer using free tools.

Traffic Monitoring with Wireshark:

Install Wireshark (wireshark.org) and capture traffic for 5 minutes:

# Use these display filters during capture:
http             # See all HTTP requests
dns              # See which websites are being resolved
tcp.port == 443  # See HTTPS connections

Record what you find:

Bandwidth Monitoring (Command Line):

# Windows (Resource Monitor):
# Open Task Manager → Performance → Open Resource Monitor → Network

# Linux: Install and use nload
sudo apt install nload      # Debian/Ubuntu
sudo nload

# macOS: Use nload or Activity Monitor
brew install nload
nload

Record your bandwidth usage:

Ping Monitoring (Connectivity Test):

# Monitor connectivity to your gateway over time
ping -t 8.8.8.8           # Windows (continuous)
ping 8.8.8.8              # Linux/macOS (press Ctrl+C to stop)

• Minimum ping time: ______ ms
• Maximum ping time: ______ ms
• Average ping time: ______ ms
• Packet loss: ______ %

Analysis: Answer these questions based on your monitoring:

1. Which application used the most bandwidth?
2. Did you see any unexpected traffic in Wireshark?
3. Was there any packet loss? What could cause it?
4. How would you detect a sudden bandwidth spike (potential DDoS or data exfiltration)?