Network Security Groups (NSGs) and Inspecting Traffic Between Azure Virtual Machines (VMs)

This lab uses Wireshark to observe network traffic between Azure VMs and experiments with Network Security Groups (NSGs) to see how rules affect connectivity.

Environments and Technologies Used

• Microsoft Azure (Virtual Machines/Compute)
• Remote Desktop Protocol (RDP)
• Wireshark (protocol analyzer)
• Command-Line Tools
• Common protocols: SSH, RDP, DNS, HTTP/S, ICMP
• Wireshark (Protocol Analyzer)

Operating Systems Used

• Windows 10 (21H2) - Client VM (Wireshark + RDP)
• Ubuntu Server 20.04 - Linux VM (SSH target)

High-Level Steps

• Create a Resource Group and two VMs (Windows 10 + Ubuntu) in the same VNet/subnet
• Use Wireshark on Windows to capture traffic
• Generate traffic (ICMP, SSH, DHCP, DNS, RDP) and observe filters
• Use NSGs to block/allow traffic and watch the impact in real time

Actions and Observations

Step 1: Set up your virtual environment

Two VMs in the same Resource Group and VNet.

1. Create a Resource Group (e.g., NSG-network). Choose a nearby region (e.g., West US 2)
2. Create the Windows 10 VM (client). Let Azure create a new VNet + subnet. Use password auth.
3. Create the Ubuntu 20.04 VM in the same Resource Group and VNet/subnet. Use password auth.
4. (Optional) Inspect the network topology in Network Watcher.

---

Step 2: Observe ICMP (Ping)

See ping traffic in Wireshark and how an NSG rule changes it.

1. RDP into the Windows 10 VM, install and open Wireshark.

2. Set the display filter to ICMP

3. Find the private IP of the Ubuntu VM and ping it from Windows:

   ping <UBUNTU_PRIVATE_IP>

   Watch requests/replies in Wireshark.

4. Try pinging a public site:

   ping www.google.com

   Watch requests/replies in Wireshark.

5. Start a continuous ping (leave it running):

   ping -t <UBUNTU_PRIVATE_IP>

6. Block ICMP to Ubuntu using its NSG:
   • Go to the Ubuntu VM’s Network interface → NSG → Inbound security rules → Add
   • Source/Destination: Any ➤ Protocol: ICMP ➤ Action: Deny ➤ Priority: (low number, e.g., 100) → Save
   • Back on Windows, observe ping timeouts and Wireshark drops

7. Re-enable ICMP (disable or remove the deny rule). Pings should resume.

---

Step 3: Observe SSH

Watch encrypted SSH traffic to Ubuntu.

1. In Wireshark, set filter to SSH

2. From Windows, connect to Ubuntu:

   ssh <username>@<UBUNTU_PRIVATE_IP>

3. Run a few commands (ls, pwd, etc.) and watch the encrypted packets.

4. Exit with:

   exit

---

Step 4: Observe DHCP

See the DHCP lease workflow.

1. In Wireshark, set filter to BOOTP (Wireshark labels DHCP as BOOTP)

2. On Windows:

   ipconfig /renew

   Observe the DISCOVER/OFFER/REQUEST/ACK exchange.

---

Step 5: Observe DNS

Watch DNS queries and responses.

1. In Wireshark, set filter to DNS

2. On Windows:

   nslookup google.com
   nslookup disney.com

3. See the A/AAAA lookups and responses.

---

Step 6: Observe RDP

Recognize continuous RDP traffic.

1. In Wireshark, set filter to tcp.port==3389 (Wireshark label for RDP)
2. You’ll see a constant stream in Administrator: Windows PowerShell. RDP continuously sends screen updates/input events, so traffic persists even when idle.

---

Congratulations! Hopefully, you were able to inspect all traffic without any hiccups.

---

Troubleshooting

• If your filters show nothing, confirm you’ve selected the right network interface in Wireshark and that both VMs are on the same VNet/subnet.

---

Cleanup

• Delete the Resource Group(s) and VMs in Azure once done to avoid charges.

Closing Thoughts

Completing this NSG and traffic inspection lab made networking feel real. I captured ICMP, SSH, DHCP, DNS, and RDP in Wireshark, then tweaked NSG rules to allow/deny traffic and monitored the impact in real time. That end-to-end loop of configure → test → observe → fix mirrors how IT teams secure, troubleshoot, and operate networks every day.