COMP416 Lab (1) Wireshark I. 23 September 2013

Transcription

1 COMP416 Lab (1) Wireshark I 23 September 2013

2 2 Before the lab Review the content of communication architecture. Review TCP/IP model and protocol suite. Understand data transferring, layering, and encapsulation/demultiplexing.

3 3 Content Data capture basis and tools Getting start with Wireshark Advanced usage Traffic and protocol analysis

4 4 Packet capture Why do we need to capture packets? troubleshoot network problems examine security problems debug protocol implementations learn network protocol internals

5 5 Packet capture tools/sniffers Classic tools WireShark ( TCPDump ( Other tools Ettercap Dsniff Ntop KISMET WinDump Tshark

6 6 What is Wireshark? An open source packet analyzer capture network packets display that packet data Decode 1115 protocols (v1.4) Support command-line and GUI interfaces Run on many platforms, including Windows, OS X, Linux, and UNIX Many online resources Wireshark User s Guide (

7 7 How does Wireshark work? Windows Linux Wireshark Winpcap libpcap

8 8 Libpcap and Winpcap Libpcap and winpcap are libraries for network traffic capture, provides the core functions of packet capturing Linux/Unix -> libpcap Windows -> winpcap Homepage of libpcap: Homepage of winpcap:

9 9 TCPDump and WinDump Tcpdump Unix-based command-line tool used to analyze packets Including filtering to just capture the packets of interest Capture packets from interface specified using -i option Read packets from an existing trace file specified using -r option Save captured packets using -w option Homepage: WinDump The Windows version of tcpdump Homepage:

10 10 Basic usage Tip: packet capture need root / administrator privileges Packet capture: select the right interface! Save / open trace

11 11 Advanced usage (1): filters Capture filters Only the packets meet the rule will be captured and decoded in Wireshark Syntax Specify protocols: ip, tcp, udp Specify host: host, dst, src More filters can be found: Display filters Do not affect captured packets Only determine whether or not to display some packets Syntax Useful: Follow TCP Stream More filters can be found:

12 12 Advanced usage (2) Follow a stream Stream: [IP address A, port A, IP address B, port B] Adjust the layout and columns Edit -> Preference Statistics Summary: general statistics about the current capture file Conversations: statistics of the captured conversations Conversation is the traffic between two specific endpoints Endpoints: traffic statistics of an end host IO Graphs: visualizing the number of packets in time

13 13 Analyze Web application The World Wide Web (WWW) is the most popular Internet application Answer the following question: What s the relationship between Web and HTTP? What type of protocol does HTTP belong to? What happen in the background when you access a Web site through a Web browser?

14 14 Exercise 1:analyze HTTP traffic Y:\Win32\WiresharkPortable Select the right interface Visit After the page is fully loaded, stop capturing. Analyze HTTP traffic What have you observed? Write down the protocols you have observed Consider why you can observe so much traffic and protocols besides the HTTP traffic

15 15 Exercise 1 (cont d) Analyze HTTP traffic What s your HTTP request method? What s your HTTP request version? What s the status code in the response? What does it mean? Apply a display filter so that only HTTP packets are shown. How many HTTP requests have been sent to the Web server? Write down each request.

16 16 Exercise 2 Try to different capture filters How can I capture only HTTP traffic? How can I only capture only the traffic from/to a specified host? Visit and analyze the HTTP traffic What s your IP address? What s the server s IP address? How many TCP connections were opened? Visit and analyze the HTTP traffic What s the difference as compared with the previous steps?

17 17 Exercise 2 (cont d) Visit and analyze HTTP traffic What s the difference as compared with the previous steps? How many Web servers have you accessed? Write down the servers exact IP addresses. Explain this phenomenon.

18 18 Exercise 3 Delete the capture filter. Start a new capture. Visit When the page is fully loaded, stop capturing. Compare the throughput between UDP and TCP in a time series.

19 19 Exercise 4 Start a new capture. Visit When the page is fully loaded, stop capturing. Identify the HTTPS traffic. What s the default port of HTTPS? What can you see after applying follow the TCP stream? Write down the process of how an https connection is established.

20 20 Exercise 5 Visit and analyze the HTTP traffic. Record the IP address of the Facebook server. Save the trace. Visit Facebook again at home, and compare the trace you obtained in campus. Record the IP address of the Facebook server. Is the IP address recorded at home the same as the one recorded in campus? If not, explain why.

21 21 Further reading CDN (content delivery network)