3.4.1.2 Lab - Using Wireshark to View Network Traffic
Lab - Using Wireshark to View Network
Traffic
Topology
Objectives
Part 1: Capture and Analyze
Local ICMP Data in Wireshark
Part 2: Capture and Analyze
Remote ICMP Data in Wireshark
Background / Scenario
Wireshark is a software protocol
analyzer, or "packet sniffer" application, used for network
troubleshooting, analysis, software and protocol development, and education. As
data streams travel back and forth over the network, the sniffer
"captures" each protocol data unit (PDU) and can decode and analyze
its content according to the appropriate RFC or other specifications.
Wireshark is a useful tool for anyone
working with networks and can be used with most labs in the CCNA courses for
data analysis and troubleshooting. In this lab, you will use Wireshark to
capture ICMP data packet IP addresses and Ethernet frame MAC addresses.
Required Resources
·
1 PC (Windows 7 or 8 with Internet
access)
·
Additional PC(s) on a
local-area network (LAN) will be used to reply to ping requests.
Part 1:
Capture and Analyze Local ICMP
Data in Wireshark
In Part 1 of this lab, you
will ping another PC on the LAN and capture ICMP requests and replies in
Wireshark. You will also look inside the frames captured for specific
information. This analysis should help to clarify how packet headers are used
to transport data to their destination.
Step 1:
Retrieve your PC’s interface
addresses.
For this lab, you will need to retrieve
your PC’s IP address and its network interface card (NIC) physical address,
also called the MAC address.
a.
Open a command window, type ipconfig /all, and then press Enter.
b.
Note your PC interface’s IP address
and MAC (physical) address.
c.
Ask a team member for their
PC’s IP address and provide your PC’s IP address to them. Do not provide them with
your MAC address at this time.
Step 2:
Start Wireshark and begin
capturing data.
a.
On your PC, click the Windows Start button to see Wireshark listed as
one of the programs on the pop-up menu. Double-click Wireshark.
b.
After Wireshark starts, double-click
Ethernet or other available active
interface.
Note: The wavelike line indicates active interface.
Information will start scrolling down the
top section in Wireshark. The data lines will appear in different colors based
on protocol.
c.
This information can scroll by very
quickly depending on what communication is taking place between your PC and the
LAN. We can apply a filter to make it easier to view and work with the data
that is being captured by Wireshark. For this lab, we are only interested in
displaying ICMP (ping) PDUs. Type icmp
in the Filter box at the top of Wireshark and press Enter or click on the blue arrow button (to apply new filter
setting) to view only ICMP (ping) PDUs.
d.
This filter causes all data in
the top window to disappear, but you are still capturing the traffic on the
interface. Bring up the command prompt window that you opened earlier and ping
the IP address that you received from your team member. Notice that you start
seeing data appear in the top window of Wireshark again.
Note: If your team member’s PC does not reply to your pings, this may be
because their PC firewall is blocking these requests. Please see Appendix A: Allowing ICMP Traffic Through a Firewall for information on how to allow ICMP traffic through the firewall using
Windows 7.
e.
Stop capturing data by clicking
the Red Square icon.
Step 3:
Examine the captured data.
In Step 3, examine the
data that was generated by the ping requests of your team member’s PC.
Wireshark data is displayed in three sections: 1) The top section displays the
list of PDU frames captured with a summary of the IP packet information listed,
2) the middle section lists PDU information for the frame selected in the top
part of the screen and separates a captured PDU frame by its protocol layers,
and 3) the bottom section displays the raw data of each layer. The raw data is displayed
in both hexadecimal and decimal form.
a.
Click the first ICMP request
PDU frames in the top section of Wireshark. Notice that the Source column has
your PC’s IP address, and the Destination contains the IP address of the
teammate’s PC you pinged.
b.
With this PDU frame still
selected in the top section, navigate to the middle section. Click the plus
sign to the left of the Ethernet II row to view the Destination and Source MAC
addresses.
Does the Source
MAC address match your PC’s interface? __yes____
Does
the Destination MAC address in Wireshark match your team member’s MAC address?
_yes____
How is
the MAC address of the pinged PC obtained by your PC?
The MAC address is obtained through an ARP request ___________________________________________________________________________________
Note: In the preceding example of a captured ICMP request, ICMP data is encapsulated inside an IPv4 packet PDU (IPv4 header) which
is then encapsulated in an Ethernet II frame PDU (Ethernet II header) for
transmission on the LAN.
Part 2:
Capture and Analyze Remote ICMP
Data in Wireshark
In Part 2, you will ping
remote hosts (hosts not on the LAN) and examine the generated data from those
pings. You will then determine what is different about this data from the data examined
in Part 1.
Step 1:
Start capturing data on the
interface.
a.
Click the Blue shark fin icon to start capturing again.
b.
A window prompts to save the
previously captured data before starting another capture. It is not necessary
to save this data. Click Continue without
Saving.
c.
With the capture active, ping
the following three website URLs:
1)
www.yahoo.com
2)
www.cisco.com
3)
www.google.com
Note: When you ping the URLs listed, notice that the Domain Name Server
(DNS) translates the URL to an IP address. Note the IP address received for
each URL.
d.
You can stop capturing data by
clicking the Red Square icon.
Step 2:
Examining and analyzing the
data from the remote hosts.
a.
Review the captured data in
Wireshark, examine the IP and MAC addresses of the three locations that you
pinged. List the destination IP and MAC addresses for all three locations in
the space provided.
1st Location: IP: 98.138.219.231
__._____ MAC: 00:00:0c:07:ac:17
2nd Location: IP: 72.163.4.185
____._____ MAC: 00:00:0c:07:ac:17
3rd Location: IP: 172.217.10.46
___._____ MAC: 00:00:0c:07:ac:17
b.
What is significant about this
information?
All of the MAC addresses are the same. ___________________________________________________________________
c.
How does this information
differ from the local ping information you received in Part 1?
_____________________________Local ping gives you you the
MAC address whereas the ping to a remote host doesn’t._______________________________________________________
____________________________________________________________________________________
Reflection
Why does Wireshark show the actual MAC
address of the local hosts, but not the actual MAC address for the remote
hosts?
____Because
it is within its own network within its own security , whereas on remote hosts
it does not have the privilege to acquire the MAC address.___________________________________________________________________________________
_______________________________________________________________________________________
If the members of your team are unable
to ping your PC, the firewall may be blocking those requests. This appendix describes
how to create a rule in the firewall to allow ping requests. It also describes how
to disable the new ICMP rule after you have completed the lab.
Step 1:
Create a new inbound rule
allowing ICMP traffic through the firewall.
a.
From the Control Panel, click
the System and Security option.
b.
From the System and Security
window, click Windows Firewall.
c.
In the left pane of the Windows
Firewall window, click Advanced settings.
d.
On the Advanced Security
window, choose the Inbound Rules
option on the left sidebar and then click New
Rule… on the right sidebar.
e.
This launches the New Inbound
Rule wizard. On the Rule Type screen, click the Custom radio button and click Next
f.
In the left pane, click the Protocol and Ports option and using the
Protocol type drop-down menu, select ICMPv4,
and then click Next.
g.
In the left pane, click the Name option and in the Name field, type
Allow ICMP Requests. Click Finish.
This new rule should allow your team
members to receive ping replies from your PC.
Step 2:
Disabling or deleting the new
ICMP rule.
After the lab is complete, you may want
to disable or even delete the new rule you created in Step 1. Using the Disable Rule option allows you to
enable the rule again at a later date. Deleting the rule permanently deletes it
from the list of Inbound Rules.
a.
On the Advanced Security
window, click Inbound Rules in the
left pane and then locate the rule you created in Step 1.
b.
To disable the rule, click the Disable Rule option. When you choose
this option, you will see this option change to Enable Rule. You can toggle back and forth between Disable Rule and
Enable Rule; the status of the rule also shows in the Enabled column of the
Inbound Rules list.
c.
To permanently delete the ICMP
rule, click Delete. If you choose
this option, you must re-create the rule again to allow ICMP replies.
http://erdoganakbiyik.blogspot.com/
https://www.youtube.com/channel/UCDsUnmBfVdEPkcC8FlzPKcg
No comments:
Post a Comment