Capture Telnet Passwords in GNS3 Using Wireshark

Nerd Cafe | نرد کافه

What is Telnet?

  • Telnet is a network protocol used to access remote computers over a network

  • Works on a client–server model

  • Allows users to execute commands on a remote machine

How Telnet Works

  • Uses TCP for communication

  • Default port: 23

  • User connects using:

    • IP address or hostname

    • Username and password

  • Provides a command-line interface to the remote system

Advantages of Telnet

  • Simple and easy to use

  • Low resource usage

  • Useful for testing network services

  • Supported on many operating systems

Disadvantages of Telnet

  • No encryption (data sent in plain text)

  • Vulnerable to:

    • Packet sniffing

    • Man-in-the-middle attacks

  • Not safe for sensitive data

Security Concerns

  • Passwords can be easily intercepted

  • Not recommended for modern secure communication

  • Mostly replaced by SSH (Secure Shell)

Telnet vs SSH

  • Telnet:

    • No encryption

    • Insecure

  • SSH:

    • Encrypted communication

    • Secure authentication

    • Widely used today

Telnet Configuration Tutorial - Step by Step

1. Network Topology Overview:

2. Configure the Router (R1) for Telnet Access

  • Double-click the Router to open its CLI tab.

  • Enter the following commands step by step (press Enter after each):

3. Verify Basic Connectivity

  • From the Client PC's CLI (Desktop > Command Prompt):text

  • You should see successful replies, confirming Layer 3 connectivity.

4. Initiate the Telnet Session from the Client

  • On the Client PC, go to Desktop > Command Prompt (or Terminal).

  • Enter:

  • When prompted:

    • Username: nerd

    • Password: cafe (it won't echo on screen).

  • You should see R1> prompt, indicating successful login.

  • Type exit to close the session.

5. Capture the Packets in GNS3 with Wireshark

  • In GNS3, right-click the link between the switch and router (or client and switch) → Start capture.

  • GNS3 launches Wireshark automatically, capturing live traffic on the selected virtual link.

  • Apply a filter in Wireshark: tcp.port == 23 or telnet.

  • Immediately perform (or repeat) the Telnet login from the client (step 4) to capture the session.

  • Stop capture when done: Right-click the link → Stop capture.

6. Analyze the Capture

  • In Wireshark, filter for the Telnet stream (e.g., tcp.stream eq 1).

  • Right-click a packet → FollowTCP Stream → set view to ASCII.

  • You will see the full clear-text conversation:

    • "User Access Verification"

    • "Username: nerd"

    • "Password: cafe"

    • Router prompt and any typed commands

  • Packet details show Ethernet/IP/TCP headers + unencrypted Telnet payload (credentials visible in plain text).

  • This matches the insecure Telnet behavior in your screenshot.

💖 Support Our Work

If you find this post helpful and would like to support my work, you can send a donation via TRC-20 (USDT). Your contributions help us keep creating and sharing more valuable content.

circle-check

Thank you for your generosity! 🙏

Keywords

GNS3, Wireshark, Telnet, packet capture, TCP stream, clear-text credentials, Cisco router, username password, login local, VTY lines, FastEthernet0/0, IP configuration, three-way handshake, follow TCP stream, ASCII view, insecure protocol, network simulation, Ethernet switch, VPCS client, plain-text authentication, nerd cafe , نرد کافه

Channel Overview

🌐 Website: www.nerd-cafe.irarrow-up-right

📺 YouTube: @nerd-cafearrow-up-right

🎥 Aparat: nerd_cafearrow-up-right

📌 Pinterest: nerd_cafearrow-up-right

📱 Telegram: @nerd_cafearrow-up-right

📝 Blog: Nerd Café on Virgoolarrow-up-right

💻 GitHub: nerd-cafearrow-up-right

Last updated