Kali VM & Network Visibility
Completed hands-on experience connecting isolated attack activity to packet evidence, IDS alerts and analyst review.
Completed lab experience: attack simulation, 5,000+ packets reviewed and Snort rule tuning.
My completed lab experience
I used an isolated VMware environment with Kali Linux to simulate scanning, brute-force and exploitation activity against lab targets. I reviewed more than 5,000 captured packets in Wireshark, then implemented and tuned Snort rules for the simulated traffic.
The value of the exercise was seeing the same activity from both sides: what the Kali VM generated, what appeared on the network and what an analyst could support from the retained evidence.
How I worked through the network evidence
- Bound the virtual lab. Keep the Kali VM and target systems on an isolated network with known scope.
- Generate controlled activity. Use the lab to produce reconnaissance and attack-like traffic without targeting public systems.
- Inspect packets in Wireshark. Review protocols, conversations, ports and timing to understand what crossed the network.
- Tune Snort detections. Compare rule logic with the captured traffic and refine signals that were too broad or noisy.
- Carry the question into Splunk. Use available event context to organize the activity into an analyst-readable timeline rather than treating an alert as a conclusion.
Network evidence you can inspect here
The original 5,000+ packet capture is not stored in this public repository. The visuals below come from a separate, reproducible 20-frame portfolio fixture and show how I document packet evidence now.
What I would explain to an employer
I can explain how an attacker-side action becomes network evidence, how an IDS rule selects part of that activity and why the analyst still needs context. I would also be direct about the evidence boundary: the broader experience is owner-confirmed and résumé-reported; the smaller public fixture is independently reproducible in this repository.
Related network work
Read the detailed network intrusion case ↗ · Inspect the reproducible packet case ↗ · Follow the Splunk investigation workflow ↗
Academic foundation
Completed coursework: IST 4620 Penetration Testing & Ethical Hacking and IST 4210 Advanced Networking & Security (Fall 2024).
Scope and evidence
The Kali, VMware, Wireshark, Snort and broader packet-analysis experience is owner-confirmed and described in the supplied résumé. The Kali desktop is an attributed reference image. The three network visuals are generated from the separate public fixture; none is presented as the missing original VM screenshot or 5,000+ packet capture. This page performs no scanning.