Wireshark summary report

This lab will introduce you to “packet sniffing,” a method by which we can capture packets being sent between computers as they communicate. As a network administrator you can use this method to help evaluate the performance of your network by identifying bottlenecks and slower performing servers or sections of your network. You can also use it to check the security of your network.

Overview & Prerequisites

You will first install a program called Wireshark. This is an open source application freely available on the Internet that allows you to capture packets as they appear at the network adaptor card. This means that you will be able to see all header information on the packet from each of the OSI layers. (Normally these headers are stripped off so that the only portion remaining is the data payload.) You will use the software to view complete packets and locate each layer’s header, from the physical layer to the application layer. Doing so will help you to better understand network traffic and identify things that are “out of order.” Using this program you will:

Analyze simple protocols and learn about the software interface and the information it contains;
Observe, analyze and reconstruct specific packet interchanges between a computer and a server
For this lab, you will need a single computer with an Internet connection.

(Optional FTP Part is given for those who want to try it.)

Directions
To obtain the software that you will use for this lab, go to www.wireshark.org and download it to your workstation. Once downloaded, you can install the software and accept all defaults. The program includes a helper program called WinPCap, which will install after Wireshark is installed.

Part 1: Analyzing simple protocols

After you have installed Wireshark, start the program. The initial screen will resemble Figure 1. Notice that your local interface is listed (if you have multiple interfaces, you may see more than one entry; the names may vary). You can click the interface and press “Start” to begin packet capture. (Your interface may be different, depending upon Wireshark version.)