Lab Objective:
Learn how to use the Wireshark packet sniffer.
Lab Purpose:
Most network engineers avoid using packet sniffers because they don’t understand them, but with just a couple of hours of effort you can become quite proficient. This lab will give you a basic introduction to Wireshark.
Lab Tool:
Any Windows PC
Lab Topology:
Please use the following topology to complete this lab exercise. I used a virtual Windows 10 PC running inside VirtualBox, but if you are using Windows, you can use your home PC. Just check your firewall settings don’t block the test. I installed Wireshark onto my VM, but you can just as easily put it on your home PC and then remove it after your test.
Lab Walkthrough:
Task 1:
Pull up a command prompt by typing ‘cmd’ into the search box.
Task 2:
At the command prompt, issue the ipconfig /all command. Check which interface you are using to get internet access.
Task 3:
Open Wireshark and confirm you are capturing packets (sniffing) on the correct interface. Click on the interface name to open the capture. Your interface name may differ from mine depending on your device and configuration.
Task 4:
Press the interface name to open Wireshark. There will already be some generic traffic passing through the interface, but we want to send specific traffic out and check the packet captures. Note that my Ethernet interface is 10.0.2.15.
Task 5:
From a command prompt ping 101labs.net.
Task 6:
Stop the captures (press the stop button) and then look at the Wireshark capture. You can click on individual packets to check the contents. The packets can be viewed at all OSI layers. Remember that ARP must be used to help our host encapsulate the packet with the next hop’s address. This is before the ping packet is sent. This is why you often see a timeout for the first ping packet.
Task 7:
Click on the layer 4 part of the first ICMP packet. Note the source (Src:) and destination (Dst:) addresses.
Task 8:
Click on the reply packet. Note where it matches the command-line output from the first ping.
Task 9:
Finally, find any TCP packet with [RST, ACK] bits. Drill down into the frame until you find them. They are not actually used for ping traffic, but it’s important you know where to find them. Don’t worry if they are turned on (1) or off (0).
Notes:
I strongly recommend you learn Wireshark. It takes only a couple of hours. We have a course at www.howtonetwork.com if you want to check it out.
I’m sure you have read about three-way handshakes in your study guide. Feel free to redo this lab, but this time searching for a telnet host. Then check for the [RST, ACK] bits.
