Lab 2.6.2: Using Wireshark

Lab 2. 6. 2 Using Wireshark to View communications communications communications protocol Data Units Learning Objectives Be able to ex field of view the purpose of a protocol analyzer (Wireshark). Be able to perform basic PDU take in using Wireshark. Be able to perform basic PDU analysis on straightforward cyberspace grantive learning concern. Experiment with Wireshark frisks and options such as PDU influence and demonstration filtering. Background Wireshark is a softwargon protocol analyzer, or pile sniffer application, used for weave troubleshooting, analysis, software and protocol development, and education. Before June 2006, Wireshark was known as Ethereal.A parcel of land sniffer (also known as a internet analyzer or protocol analyzer) is estimator software that skunk intercept and log instruction traffic maneuvering over a info network. As info streams travel back and forth over the network, the sniffer arrests each protocol data unit (PDU) and repudia tee a little decode and analyze its satisfy according to the arrogate RFC or other specifications. Wireshark is programmed to recognize the structure of different network protocols. This enables it to display the encapsulation and individual fields of a PDU and interpret their meaning.It is a useful apparatus for anyone working with networks and plenty be used with most labs in the CCNA courses for data analysis and troubleshooting. For reading and to transfer the program go to http//www. Wireshark. org Scenario To reserve PDUs the computer on which Wireshark is installed must have a working connection to the network and Wireshark must be tally before any data can be captured. When Wireshark is launched, the harbour below is displayed. pic To start data capture it is eldest necessary to go to the vex menu and select the Options choice.The Options dialog provides a range of bewildertings and filters which determines which and how much data traffic is captured. pic First , it is necessary to ensure that Wireshark is set to monitor the correct interface. From the Interface drop down tendency, select the network adapter in use. Typically, for a computer this leave be the committed Ethernet Adapter. Then other Options can be set. Among those available in perplex Options, the two highlighted below are worth examination. pic Setting Wireshark to capture software programs in promiscuous modalityIf this feature is NOT checked, only PDUs destined for this computer will be captured. If this feature is checked, all PDUs destined for this computer AND all those discover by the computer NIC on the akin network segment (i. e. , those that pass by the NIC but are non destined for the computer) are captured. advert The capturing of these other PDUs depends on the intermediary device connecting the end device computers on this network. As you use different intermediary devices (hubs, switches, routers) throughout these courses, you will work through the different Wireshark results.Setting Wireshark for network evoke resolution This option allows you to control whether or not Wireshark translates network addresses found in PDUs into names. Although this is a useful feature, the name resolution subprogram whitethorn add extra PDUs to your captured data maybe distorting the analysis. There are also a number of other capture filtering and process settings available. Clicking on the perish button starts the data capture process and a message box displays the progress of this process. pic As data PDUs are captured, the types and number are indicated in the message box picpic The workouts above award the capture of a ping process and then accessing a web page. When the Stop button is clicked, the capture process is terminated and the main screen is displayed. This main display window of Wireshark has three supermans. pic The PDU (or tract) controversy Pane at the top of the diagram displays a summary of each packet captured. By c licking on packets in this loony toons, you control what is displayed in the other two window glasss. The PDU (or software) dilate Pane in the middle of the diagram displays the packet selected in the sheaf inclination of an orbit Pane in more detail.The PDU (or piece of land) Bytes Pane at the toilet of the diagram displays the actual data (in hexadecimal form representing the actual binary) from the packet selected in the Packet List Pane, and highlights the field selected in the Packet inside information Pane. Each termination in the Packet List corresponds to one PDU or packet of the captured data. If you select a report in this sexually transmitted disease, more expound will be displayed in the Packet features and Packet Bytes points. The example above shows the PDUs captured when the ping utility was used and http//www. Wireshark. org was accessed. Packet number 1 is selected in this pane.The Packet Details pane shows the on-going packet (selected in the Packet List pane) in a more detailed form. This pane shows the protocols and protocol fields of the selected packet. The protocols and fields of the packet are displayed using a tree, which can be grow and collapsed. The Packet Bytes pane shows the data of the current packet (selected in the Packet List pane) in what is known as hexdump style. In this lab, this pane will not be examined in detail. However, when a more in-depth analysis is required this displayed information is useful for examining the binary value and content of PDUs.The information captured for the data PDUs can be saved in a file. This file can then be undefended in Wireshark for analysis some time in the future without the need to re-capture the same data traffic again. The information displayed when a capture file is opened is the same as the original capture. When closing a data capture screen or exiting Wireshark you are prompted to save the captured PDUs. pic Clicking on Continue without speech closes the file o r exits Wireshark without saving the displayed captured data. Task 1 Ping PDU arrestStep 1 After ensuring that the standard lab topology and configuration is correct, launch Wireshark on a computer in a lab pod. Set the Capture Options as described above in the overview and start the capture process. From the operate line of the computer, ping the IP address of another network connected and powered on end device on in the lab topology. In this case, ping the Eagle Server at using the dominate ping 192. 168. 254. 254. After receiving the successful replies to the ping in the command line window, stop the packet capture. Step 2 Examine the Packet List pane.The Packet List pane on Wireshark should now get a line something standardized this pic Look at the packets contestationed above we are interested in packet numbers 6, 7, 8, 9, 11, 12, 14 and 15. Locate the equivalent packets on the packet list on your computer. If you performed Step 1A above match the messages displayed in th e command line window when the ping was issued with the six packets captured by Wireshark. From the Wireshark Packet List reception the following What protocol is used by ping? _icmp_____________________________ What is the full protocol name? _____________________________ What are the names of the two ping messages? __ ricochet ping requet, echo ping reply _____________________________________________________________________ Are the listed source and destination IP addresses what you anticipate? Yes / No Why? _no. frst time using wireshark. Results are amazing______________________ Step 3 fill (highlight) the first echo request packet on the list with the mouse. The Packet Detail pane will now display something standardized to pic Click on each of the four + to expand the information.The packet Detail Pane will now be similar to pic As you can see, the details for each section and protocol can be expanded further. Spend some time scrolling through this information. At this stage of the course, you may not richly understand the information displayed but make a note of the information you do recognize. Locate the two different types of solution and Destination. Why are there two types? __________________________________________________________________ What protocols are in the Ethernet purge? ____________________________________________________________As you select a line in the Packets Detail pane all or part of the information in the Packet Bytes pane also becomes highlighted. For example, if the second line (+ Ethernet II) is highlighted in the Details pane the Bytes pane now highlights the corresponding values. pic This shows the particular binary values that represent that information in the PDU. At this stage of the course, it is not necessary to understand this information in detail. Step 4 Go to the File menu and select Close. Click on Continue without Saving when this message box appears. picTask 2 transfer PDU Capture Step 1 Start packet captur e. assume Wireshark is still running from the previous steps, start packet capture by clicking on the Start option on the Capture menu of Wireshark. At the command line on your computer running Wireshark, enter file transfer protocol 192. 168. 254. 254 When the connection is established, enter unidentified as the user without a password. Userid unknown Password You may alternatively use login with userid cisco and with password cisco. When successfully logged in enter get /pub/eagle_labs/eagle1/chapter1/gaim-1. 5. 0. exe and press the enter tonality .This will start downloading the file from the transfer server. The output will look similar to CDocuments and Settingsccna1ftp eagle-server. example. com Connected to eagle-server. example. com. 220 Welcome to the eagle-server FTP service. User (eagle-server. example. com(none)) anonymous 331 Please specify the password. Password 230 Login successful. ftp get /pub/eagle_labs/eagle1/chapter1/gaim-1. 5. 0. exe 200 user interface co mmand successful. Consider using PASV. 150 Opening BINARY mode data connection for pub/eagle_labs/eagle1/chapter1/gaim-1. 5. 0. exe (6967072 bytes). 26 File send OK. ftp 6967072 bytes received in 0. 59Seconds 11729. 08Kbytes/sec. When the file download is complete enter quit ftp quit 221 Goodbye. CDocuments and Settingsccna1 When the file has successfully downloaded, stop the PDU capture in Wireshark. Step 2 Increase the size of the Wireshark Packet List pane and scroll through the PDUs listed. Locate and note those PDUs associated with the file download. These will be the PDUs from the Layer 4 protocol transmission control protocol and the Layer 7 protocol FTP. Identify the three groups of PDUs associated with the file transfer.If you performed the step above, match the packets with the messages and prompts in the FTP command line window. The first group is associated with the connection phase and enter into the server. List examples of messages exchanged in this phase. __________ _________________________________________________________ Locate and list examples of messages exchanged in the second phase that is the actual download request and the data transfer. __________________________________________________________________ ___________________________________________________________________The one-third group of PDUs relate to logging out and breaking the connection. List examples of messages exchanged during this process. __________________________________________________________________ ___________________________________________________________________ Locate recurring TCP exchanges throughout the FTP process. What feature of TCP does this indicate? ___________________________________________________________________ ___________________________________________________________________ Step 3 Examine Packet Details. Select (highlight) a packet on the list associated with the first phase of the FTP process.View the packet details in the Details pane. What are the protocols encapsulated in the frame? ___________________________________________________________________ Highlight the packets containing the user name and password. Examine the highlighted helping in the Packet Byte pane. What does this say about the security of this FTP login process? ___________________________________________________________________ Highlight a packet associated with the second phase. From any pane, locate the packet containing the file name. The filename is ______________________________Highlight a packet containing the actual file content note the plain text visible in the Byte pane. Highlight and examine, in the Details and Byte panes, some packets exchanged in the third phase of the file download. What features distinguish the content of these packets? ___________________________________________________________________ When finished, close the Wireshark file and come about without saving Task 3 HTTP PDU Capture Step 1 Start packet capture. Assumin g Wireshark is still running from the previous steps, start packet capture by clicking on the Start option on the Capture menu of Wireshark.Note Capture Options do not have to be set if continuing from previous steps of this lab. erect a web browser on the computer that is running Wireshark. bring in the URL of the Eagle Server of example. com or enter the IP address-192. 168. 254. 254. When the webpage has fully downloaded, stop the Wireshark packet capture. Step 2 Increase the size of the Wireshark Packet List pane and scroll through the PDUs listed. Locate and identify the TCP and HTTP packets associated with the webpage download. Note the similarity between this message exchange and the FTP exchange.Step 3 In the Packet List pane, highlight an HTTP packet that has the notation (text/html) in the Info column. In the Packet Detail pane click on the + next to Line-based text data html When this information expands what is displayed? _______________________________________________ ____________________ Examine the highlighted portion of the Byte Panel. This shows the HTML data carried by the packet. When finished close the Wireshark file and continue without saving Task 4 Reflection Consider the encapsulation information pertaining to captured network data Wireshark can provide.Relate this to the OSI and TCP/IP layer models. It is important that you can recognize and link both the protocols represented and the protocol layer and encapsulation types of the models with the information provided by Wireshark. Task 5 Challenge Discuss how you could use a protocol analyzer such as Wireshark to (1)Troubleshoot the failure of a webpage to download successfully to a browser on a computer. and (2)Identify data traffic on a network that is requested by users. _____________________________________________________________________________ _____________________________________________________________________________ ___________________________________________________________ _________________ _____________________________________________________________________________ _____________________________________________________________________________ _____________________________________________________________________________ _____________________________________________________________________________ Task 6 Cleanup Unless instructed otherwise by your instructor, exit Wireshark and properly shutdown the computer. Packet List Pane Packet Details Pane Packets Bytes Pane