In this lesson, you will learn how to verify that your data is truly protected while moving across a network by inspecting raw packets.
Encryption at Rest vs. In Transit
Data security is categorized by where the data lives. Encryption at rest protects data stored on physical media (like your database or hard drive), usually via disk-level encryption. Encryption in transit protects data as it moves between your Node.js server and a client. If someone intercepts the traffic between these two points, they should only see scrambled, unreadable ciphertext.
Seeing is Believing with Wireshark
When we use HTTPS, our Node.js server uses TLS to encrypt the payload. To prove this is working, we can use a tool like Wireshark. Wireshark is a packet analyzer that captures every bit of data moving across your network interface.
If you create a simple Node.js HTTP server without TLS:
const http = require('http');
http.createServer((req, res) => {
res.end('Secret Data');
}).listen(8080);
When you send a request to this server and capture it with Wireshark, you can right-click the packet and select "Follow TCP Stream." You will see the plain text "Secret Data" clearly visible in the capture window.
If you switch to https.createServer with valid certificates, Wireshark will still capture the packets, but instead of "Secret Data," you will see a mess of random binary characters. Because the encryption happens before the data hits the network layer, Wireshark cannot decrypt the payload without the private key from your server’s TLS handshake.
By inspecting your traffic, you confirm that your TLS/SSL Handshake was successful and that your Security Policy Enforcement is effectively shielding sensitive information from man-in-the-middle observers. If you ever see plain text in a packet capture for a sensitive request, you know your encryption configuration is broken.
Key Takeaway: Use tools like Wireshark to inspect your network traffic; if you can read your request data in plain text, your encryption in transit is not active.