Lab 6: Packet Sniffing with Wireshark
by: James Moore, Partner: Matt Balderree
What is Wireshark: Wireshark is the world’s foremost network protocol analyzer. It lets you capture and interactively browse the traffic running on a computer network. It is the de facto (and often de jure) standard across many industries and educational institutions.
Objectives: Download and Install Wireshark from http://wireshark.org. Capture network traffic in the following activities:
- Browse a webpage on a server outside of campus.
- Do a file transfer to an FTP server.
- Test connectivity to a host with Ping.
- Acquire a network address with DHCP.
Equipment List: 2 x Mac Laptops, Wireshark Application, FireFTP Application, ethernet cable. (USED THROUGHOUT LAB)
Notes and Observations: I went to a webpage called cnet.com and captured data using Wireshark. I was able to capture DNS/HTTP/TCP. Using Wireshark I am able to determine the source IP, Destination IP, and the MAC address of the device accessing. For the FTP transfer I used a Firefox add on called FireFTP.
Along with transferring your files quickly and efficiently, FireFTP also includes more advanced features such as: directory comparison, syncing directories while navigating, SFTP, SSL encryption, search/filtering, integrity checks, remote editing, drag & drop, file hashing, and much more!
Using one of the students in our class FTP server he had setup I was able to access it via a password and transfer files to it while capturing using Wireshark. The interesting thing about this was that while capturing it would show detailed information of what I was transferring and also my user name and password. So the security of this was very low.
By testing connectivity to a host with Ping, I was able to see the ping request and capture ARP table information.
For the next portion of the lab is where I ran into problems. Trying to acquire a network address with DHCP. To do this I attempted first to unlock the user root. First by going to system preferences, accounts, login options, network account server join, open directory utility, then under Edit tab “enable root user.” The next step was trying to drop my IP address and try to get a newly assigned IP address all while capturing this via Wireshark. To try and release my IP address using a MAC I did the following:
- Click the Apple icon and select System Preferences….
- Click Network.
- Select Built-in Ethernet and click Configure.
- Click Renew DHCP Lease.
The problem that arose is that I was receiving the exact same IP address so I wasn’t sure if this renewal was working. While troubleshooting this and trying over and over again this is as far as I got in the lab.
Diagrams, Flowcharts, and Figures:
Here is an example of what Wireshark looks like while capturing data.
References: Lab handout, Wireshark.org, Firefox and FireFTP, spyhill.com, helpdesk.illinoisstate.edu
Find a frame containing a DNS query. What protocols are encapsulated in this frame? Which of these protocols is a transport layer protocol? eth/ip/tcp/http, The HTTP is a transport layer.
Find a frame conaining ICMP information. What protocols are encapsulated in this frame? Which layer does ICMP reside in? What do the ICMP initials mean? eth/ip/icp/ip/udp, Internet Control Message Protocol, Layer 3
Find frames containing HTTP information. Approximately how many frames did it take to download the web page? List the different protocols that are used. Note how many protocols are working together to find and retrieve the information. Facebook=5753, Arp/cups/dhcp/dhcpv6/dns/http/icmp/mpns/ssdp/tcp.
What is the purpose of sequence numbers? Is to aid TCP in reordering the packets that are sent.
What is the purpose of source & destination addresses? So that computers that exchange date know who it came from and who it needs to go to.
What is the purpose of DNS? to translate internet addresses into IP addresses for the computer to read.
What is DHCP? Domain Host Configuration Protocol, a way to assign IP addresses to computers on a network.
What is the relationship between the OSI model of networking and what you saw in this lab activity? What evidence of layered network design did you discover when examining the captured data? Both use layers to divide up different portions of the network. Both use Encapsulation.
What are the implications of having a tool like Wireshark freely available? For network administration? For Security? The implications could be that people will be able to manage their personal or other networks better, a good learning tool, negative could be hackers and people trying to steal data for identity purposes. Network administrators can pinpoint problems within their network easier. Of course security from hackers and such, makes it easier for someone to use at wireless hotspots, and other ways to steal data.
Conclusion: This lab used a great tool that is freely available and allowed me to see just how the network communicates. I can see just how useful this tool can be to the everyday person, network administrators, and even the hacker. This lab afforded me the opportunity to see all the different protocols and the data being captured on the network. I think it was a good lab, and I didn’t know tools like this existed especially free.