DEV Community

Khalif AL Mahmud
Khalif AL Mahmud

Posted on

Lab 12 - Telnet and SSH ( I Captured My Own Password in Wireshark — Here's What Telnet Taught Me About Network Security )

#networking #cybersecurity #ssh #telnet

There's a moment in networking that changes how you think about protocols forever.

You type a password into a terminal. Then you open Wireshark, follow a TCP stream, and there it is — your password, sitting in plain text, completely readable by anyone on the network.

That's Telnet. And that's exactly why this experiment is worth doing.

In this post, I'll walk you through how I set up a 4-router network in GNS3, configured Telnet and SSH on Cisco routers, and used Wireshark to visually prove why one protocol is dangerous and the other is essential.

The Problem: Why Does This Matter?

Most people learn that "SSH is better than Telnet" from documentation. But seeing it live is different.

Telnet operates on Port 23 and sends everything — usernames, passwords, commands — as unencrypted plain text over the network. SSH operates on Port 22 and encrypts every single byte using RSA key pairs.

In a real-world scenario, any attacker with access to your network traffic (via ARP spoofing, a rogue device, or misconfigured infrastructure) can intercept Telnet credentials instantly. SSH prevents this entirely.

Network Topology

Here's the topology I built in GNS3:

IP Address Summary:

Device Interface IP Address
R1 f0/0 172.16.2.16/16
R2 f0/0 172.16.2.33/16
R2 f2/0 172.25.177.254/16
R2 f3/0 172.6.16.6/16
R3 f0/0 172.6.16.17/16
R3 f1/0 172.34.5.10/16
R4 f0/0 172.25.4.192/16
R4 f1/0 172.2.2.2/16

Start Wireshark Before Anything Else

This is the most important step that beginners miss.

Before touching any configuration, start packet capture on every router link in GNS3. Right-click on each link → Start Capture. This ensures Wireshark records all configuration traffic from the very beginning.


PHASE 1 — Configure IP + RIP on All Routers (Direct Console)

R1 Console: 

Router> enable
Router# configure terminal

Router(config)# hostname R1
R1(config)# interface fastethernet 0/0
R1(config-if)# ip address 172.16.2.16 255.255.0.0
R1(config-if)# no shutdown
R1(config-if)# exit

R1(config)# router rip
R1(config-router)# version 2
R1(config-router)# network 172.16.0.0
R1(config-router)# no auto-summary
R1(config-router)# exit
R1(config)# exit

R1# write memory
Enter fullscreen mode Exit fullscreen mode

R1 is our "management router" — everything else gets configured from here via Telnet.

The no shutdown command is essential — Cisco router interfaces are administratively down by default. Without this, nothing works.

Configure RIP on R1 :

What Actually Happen in wireshark After Configure R1

R2 Console: 

Router> enable
Router# configure terminal

Router(config)# hostname R2
R2(config)# interface fastethernet 0/0
R2(config-if)# ip address 172.16.2.33 255.255.0.0
R2(config-if)# no shutdown
R2(config-if)# exit

R2(config)# router rip
R2(config-router)# version 2
R2(config-router)# network 172.16.0.0
R2(config-router)# no auto-summary
R2(config-router)# exit

R2(config)# enable password cisco
R2(config)# line vty 0 4
R2(config-line)# password cisco
R2(config-line)# login
R2(config-line)# transport input telnet
R2(config-line)# exit
R2(config)# exit

R2# write memory
Enter fullscreen mode Exit fullscreen mode



What are VTY lines? They're virtual terminal lines — the "doors" through which remote users connect to a router. line vty 0 4 means we're configuring 5 simultaneous connections (0 through 4).

R3 Console: 

Router> enable
Router# configure terminal

Router(config)# hostname R3
R3(config)# interface fastethernet 0/0
R3(config-if)# ip address 172.6.16.17 255.255.0.0
R3(config-if)# no shutdown
R3(config-if)# exit

R3(config)# router rip
R3(config-router)# version 2
R3(config-router)# network 172.6.0.0
R3(config-router)# no auto-summary
R3(config-router)# exit

R3(config)# enable password cisco
R3(config)# line vty 0 4
R3(config-line)# password cisco
R3(config-line)# login
R3(config-line)# transport input telnet
R3(config-line)# exit
R3(config)# exit

R3# write memory
Enter fullscreen mode Exit fullscreen mode

R4 Console: 

Router> enable
Router# configure terminal
Router(config)# hostname R4
R4(config)# interface fastethernet 0/0
R4(config-if)# ip address 172.25.4.192 255.255.0.0
R4(config-if)# no shutdown
R4(config-if)# exit
R4(config)# router rip
R4(config-router)# version 2
R4(config-router)# network 172.25.0.0
R4(config-router)# no auto-summary
R4(config-router)# exit
R4(config)# enable password cisco
R4(config)# line vty 0 4
R4(config-line)# password cisco
R4(config-line)# login
R4(config-line)# transport input telnet
R4(config-line)# exit
R4(config)# exit
R4# write memory
Enter fullscreen mode Exit fullscreen mode

PHASE 2 — Configure PCs (VPCS)

PC1: 

ip 172.2.3.3 255.255.0.0 172.2.2.2
save
Enter fullscreen mode Exit fullscreen mode

PC2: 

ip 172.34.10.67 255.255.0.0 172.34.5.10
save
Enter fullscreen mode Exit fullscreen mode

PHASE 3 — From R1, Telnet into R2, R3, R4 and Configure Remaining Interfaces + RIP

✅ First Verify — Ping from R1: 

R1# ping 172.16.2.33
R1# ping 172.6.16.17
R1# ping 172.25.4.192
Enter fullscreen mode Exit fullscreen mode

All three must succeed before proceeding.

R1 → Telnet → R2: 

R1# telnet 172.16.2.33
Enter fullscreen mode Exit fullscreen mode 
Password: cisco
R2> enable
Password: cisco
R2# configure terminal

R2(config)# interface fastethernet 2/0
R2(config-if)# ip address 172.25.177.254 255.255.0.0
R2(config-if)# no shutdown
R2(config-if)# exit

R2(config)# interface fastethernet 3/0
R2(config-if)# ip address 172.6.16.6 255.255.0.0
R2(config-if)# no shutdown
R2(config-if)# exit

R2(config)# router rip
R2(config-router)# network 172.25.0.0
R2(config-router)# network 172.6.0.0
R2(config-router)# exit

R2(config)# exit
R2# write memory
R2# exit
Enter fullscreen mode Exit fullscreen mode


Wireshark will show the packets exchanged between the two routers. Right click on the 2nd last telnet packet and got to Follow -> TCP stream. You can see the console commands entered on router 1 to access router 2. It will also show the password as plaintext. If we had configured SSH instead of Telnet then the password wouldn’t be captured as plaintex




Full Command

R1 → Telnet → R3: 

R1# telnet 172.6.16.17
Enter fullscreen mode Exit fullscreen mode 
Password: cisco
R3> enable
Password: cisco
R3# configure terminal

R3(config)# interface fastethernet 1/0
R3(config-if)# ip address 172.34.5.10 255.255.0.0
R3(config-if)# no shutdown
R3(config-if)# exit

R3(config)# router rip
R3(config-router)# network 172.34.0.0
R3(config-router)# exit

R3(config)# exit
R3# write memory
R3# exit
Enter fullscreen mode Exit fullscreen mode




R1 → Telnet → R4: 

R1# telnet 172.25.4.192
Enter fullscreen mode Exit fullscreen mode 
Password: cisco
R4> enable
Password: cisco
R4# configure terminal

R4(config)# interface fastethernet 1/0
R4(config-if)# ip address 172.2.2.2 255.255.0.0
R4(config-if)# no shutdown
R4(config-if)# exit

R4(config)# router rip
R4(config-router)# network 172.2.0.0
R4(config-router)# exit

R4(config)# exit
R4# write memory
R4# exit
Enter fullscreen mode Exit fullscreen mode


PHASE 4 — Configure SSH on R4 (R4 Direct Console) 

R4# configure terminal
R4(config)# ip domain-name lab.com
R4(config)# crypto key generate rsa
Enter fullscreen mode Exit fullscreen mode

When prompted:

How many bits in the modulus [512]: 1024
Enter fullscreen mode Exit fullscreen mode 
R4(config)# ip ssh version 2
R4(config)# username admin password cisco123
R4(config)# line vty 0 3
R4(config-line)# transport input ssh telnet
R4(config-line)# login local
R4(config-line)# exit
R4(config)# exit
R4# write memory
Enter fullscreen mode Exit fullscreen mode

Why 1024 bits? SSH version 2 requires a minimum key size. Less than 768 bits won't work. 1024 is the standard starting point, though 2048+ is recommended for production environments.

login local vs login: Using login local tells the router to check the local username database we just created. Plain login only checks the VTY password — less secure.

After running configuration commands through Telnet, go to Wireshark:

  1. Find any Telnet packet
  2. Right-click → Follow → TCP Stream

You'll see the password typed at the prompt — completely readable. Every command. Every keystroke. All plain text.

This is the moment that makes the SSH comparison real.

PHASE 5 — SSH from R2 into R4 

R2# ssh -l admin 172.25.4.192
Enter fullscreen mode Exit fullscreen mode 
Password: cisco123
R4> enable
Password: cisco
R4# show running-config
Enter fullscreen mode Exit fullscreen mode

Follow the same steps as before — find an SSH packet, right-click → Follow → TCP Stream.

Compare this with the Telnet stream. The SSH stream shows only encrypted bytes — no readable text, no visible commands, no password.

Same network. Same routers. Completely different security story.

All Encrypted Data :

Final Verification

Run on every router (R1, R2, R3, R4): 

show ip interface brief
show ip route
show running-config
Enter fullscreen mode Exit fullscreen mode

With RIP v2 configured on all routers, they share routing information automatically. After about 30–60 seconds for convergence:

Ping PC2 from PC1: 

ping 172.34.10.67
Enter fullscreen mode Exit fullscreen mode

📝 Important Notes — Lessons Learned

⚠️ Note 1: RIP First, Telnet Later

Every router that you want to telnet into must have RIP configured on it beforehand — from its own console.

Reason: Telnet works over a TCP connection. For TCP to establish, packets must travel both ways. For packets to travel, routes must exist. Routes come from RIP. No RIP means no route, no route means no ping, no ping means no Telnet — connection will always time out.

✅ Correct order per router: Console → Assign IP → Configure RIP → Configure Telnet → Then telnet in from another router

⚠️ Note 2: The Chicken and Egg Trap 

Want to Telnet in    → Need Ping to work
Need Ping to work    → Need a Route
Need a Route         → Need RIP
Want to configure RIP → Need Telnet  ← 🔴 INFINITE LOOP!
Enter fullscreen mode Exit fullscreen mode

The only way out of this loop is to configure RIP from the console first, before attempting any telnet connection.

Telnet vs SSH: Side by Side

Feature Telnet SSH
Port 23 22
Encryption None RSA + AES
Password in Wireshark Fully visible Encrypted
Data Integrity No Yes
Authentication Password only Password + Public Key
Compliance Fails PCI DSS Meets PCI DSS, HIPAA
Industry Status Deprecated Standard

What We Learned

The technical takeaways:

  • Cisco router interfaces are administratively down by default — always use no shutdown
  • SSH requires a domain name and RSA key pair before it will function
  • transport input ssh blocks Telnet entirely; transport input ssh telnet allows both
  • RIP v2 needs 30–60 seconds to converge before routing works across the full network
  • Wireshark's "Follow TCP Stream" feature is one of the most powerful tools for understanding protocol behavior

The bigger picture:

  • Seeing credentials in plain text in a packet capture is more convincing than any documentation
  • Most legacy network devices still run Telnet by default — knowing how to replace it with SSH is a practical skill
  • Tools like Wireshark aren't just for attackers — they're essential for anyone building or defending networks

Common Mistakes for Beginners

1. Starting Wireshark after configuration
Always start captures before any configuration. You can't capture traffic retroactively.

2. Skipping no shutdown
If interfaces stay down, nothing will connect. Make this a habit on every interface.

3. Using less than 1024-bit RSA keys
SSH v2 won't work. Always use 1024 minimum, 2048 for anything serious.

4. Expecting instant ping success
RIP needs time to advertise routes to all routers. Wait 30–60 seconds after configuration.

5. Mixing up login and login local
login local uses the username database. login uses only the VTY password. For SSH, always use login local.

Conclusion

The gap between Telnet and SSH isn't theoretical — it's something you can see with your own eyes in a Wireshark capture. One protocol hands your credentials to anyone watching the wire. The other makes them invisible.

If you're working with Cisco devices or any network infrastructure, replacing Telnet with SSH isn't optional — it's the baseline. Every compliance framework from PCI DSS to HIPAA requires it, and now you know exactly why.

Try building this topology yourself. Capture the packets. See your password appear in plain text. It's the kind of hands-on lesson that sticks.

All configurations were done in GNS3 with Cisco IOS routers. Wireshark was used for packet analysis.

Top comments (0)