Network Sniffing

Objective:
To acquaint you with methods used to capture and analyze network traffic
You must do the following to complete this lab successfully:
1) Download and install Wireshark from the Wireshark web page, or use any PCAP analysis tool in
SimSpace.
2) Start Wireshark and put it into capture mode on your Ethernet connection.
3) Access a single web site.
4) Stop the capture mode and analyze the captured data. What do you see?
5) Clear the capture and restart the capture process.
6) Logon onto a remote service or application via your network ISP or another Internet connection
that requires authentication. What does that captured traffic show?
7) Repeat steps 8 through 9 until you have captured packets indicated below. You may have to
access different sites or network devices, or generate unique connections to capture all the
protocol types. [Hint: have you ever put your network connection in loopback mode?] If you
cannot capture a protocol, explain why you cannot.
a. ARP
b. TCP
c. UDP
d. HTTP
e. HTTPS (TLS)
f. FTP
g. ICMP
h. DNS
8) Restart your network connection and the capture process and allow it to run for 1 hour. At the
end of the hour display the network connection statistics and the network packet summary.
Compare the collected data with what your firewall displays and the packet count shown under
the network connections status found in your operating system. Then start a new capture
overnight (at least 4 hours) on your home computer connection. What activity do you see
overnight? Provide proof of your one-hour and four-hour Wireshark runs.
9) Provide a lab report that includes:
a. Your observations on the capabilities of the Wireshark program
b. A diagram of your network connection with respect to how you access the Internet
c. The network statistics and protocol summary of your connection after running an hour
d. Your MAC address from the ARP protocol
e. Any MAC addresses you see in the ARP packets
f. The matching IP addresses seen with the MAC addresses
g. Representative proof that you successfully captured packets for the protocols above
h. Observations on system information or personal information transmitted when you
access the various Internet connections you make
i. Do you see any protocols that concern you? Why do they concern you?