introduction to osi model and network analyzer...

Networking Laboratory 1/56

Sungkyunkwan University

Copyright 2000-2014 Networking Laboratory

Introduction to OSI model

and

Network Analyzer :- Introduction to Wireshark

Syed Muhammad Raza – [email protected]


An Overview

Internet Protocol Stack


Internet Protocol Stack

Consists of five layers

Derived from TCP/IP protocol stack

5. Application

4. Transport

3. Network

2. Link

1. Physical


Internet Protocol Stack Explained

Animation Video

Explanation of operation and purpose of Internet Protocol

Stack


Internet Protocol Stack Explained

Animation Video


Packet Encapsulation

22Bytes 20Bytes 20Bytes 4Bytes

64 to 1500 Bytes

The data is sent down the protocol stack

Each layer adds to the data by prepending headers


W I R E S H A R K

0010100100101011101010101


Introduction (1/3)

Network Traffic Trace

► A recording of the network packets both received by and transmitted

from a network interface

What is a pcap file?

► pcap = Packet Capture

► File format originally designed for tcpdump/libpcap

► Most widely used packet capture format


Introduction (2/3)

What is Wireshark ?

► Formerly known as Ethereal

► Wireshark is a GUI Network Protocol Analyzer

► Follows the rules of the pcap library

► Found at http://www.wireshark.org

► The complete manual is located here

http://www.wireshark.org/







https://www.wireshark.org/docs/wsug_html_chunked


Introduction (3/3)

Some of its functions

► Capturing network traffic from the interface

► Decodes packets of common protocols

► Displays the network traffic in human-readable format

Some of its uses

► Troubleshoot network problems.

► Learn network protocol internals.

► Debug protocol/program implementation.

► Examine network-related security issues


Wireshark Startup


Screen Layout of Wireshark

Packet List

The summary

line, briefly

describing what

the packet is.

Packet Details

A protocol tree is

shown in detail,

allowing you to

drill down deep

your interest

Packet Bytes

shows what the

packet looks like

when it goes

over the wire. Filename Of Current File

Menu


Basic UI Options (1/2)

Change columns in the packet list to see the information

relevant to you

► Edit -> Preferences ->Columns


Basic UI Options (2/2)

File -> Open

► Opens a packet capture file.

View -> Time Display Format

► Change the format of the packet timestamps in the packet list pane

► Switch between absolute and relative timestamps.

► Change level of precision.

View -> Name Resolution

► Allow wireshark to resolve names from addresses at different

protocol layers


Enable Protocols


Packet Capture

Capture -> Interfaces

► Available network interfaces for capture

► Total packets per interface

► Packet rate per interface


Capture Options (1/2)


Capture Options (2/2)

To Specify the interface to be monitored

To Record all traffic even not for you

Only Capture part of the packet

To Store the result in file

Automatic Stop Condition

Only Capture certain packet


Start Capturing


Stop Capturing


Display Packet Captured

Frame #

Ethernet Header

Destination Mac Address Field in Ethernet Header


Individual Packet Analysis

Packet Details

► Detailed information about the currently selected packet is displayed

in the packet details pane

► All packet layers are displayed in the tree menu

► Any portion of any layer can be exported via a right click and

selecting Export Selected Packet Bytes

Packet Bytes

► Displays the raw packet bytes

► The selected packet layer is highlighted


Trace Analysis (1/2)

Packet list

► Displays all of the packets in the trace in the order they were

recorded

► Columns

Time – the timestamp at which the packet crossed the interface

Source – the originating host of the packet

Destination – the host to which the packet was sent

Protocol – the highest level protocol that Wireshark can detect

Length – the length in bytes of the packet on the wire

Info – an informational message pertaining to the protocol in the

protocol column


Trace Analysis (2/2)

Packet list

► Default Coloring

Gray – TCP packets

Black with red letters – TCP Packets with errors

Green – HTTP Packets

Light Blue – UDP Packets

Pale Blue – ARP Packets

Lavender – ICMP Packets

Black with green letters – ICMP Packets with errors

► Colorings can be changed under View -> Coloring Rules


Column Sorting

Output is Sorted By Frame No By Default

Output is Sorted By Source Address


Conversation List


Saving Packets Captured


Capture Filters

The capture filter syntax follows the rules of the pcap

library

This syntax is different from the display filter syntax

Referring manual page of tcpdump

(http://www.tcpdump.org/tcpdump_man.html )

Sample filters:

► src ip 192.168.1.1

► ether src 00:50:BA:48:B5:EF


Capture Filters

A capture filter for HTTP than captures traffic to and from a

particular host

► tcp port 80 and host 10.10.10.5

A capture filter for HTTP than captures traffic not from a

particular host

► tcp port 80 and not host 10.10.10.5

A capture filter to and from an Ethernet address

► ether 00:00:01:01:02:22


Display Filters

C-like symbols, or through English-like abbreviations:

► eq, == Equal

► ne, != Not equal

► gt, > Greater than

► lt, < Less Than

► ge, >= Greater than or Equal to

► le, <= Less than or Equal to


Display Filters GUI

Quick Way to Learn Display

Filter Commands


Display Filters GUI

1.

2.

3.


Display Filters GUI


Display Filter Examples

Filter examples

► http.request – Display all HTTP requests

► http.request || http.response – Display all HTTP request and

responses

► ip.addr == 127.0.0.1 – Display all IP packets whose source or

destination is localhost

► tcp.len < 100 – Display all TCP packets whose data length is less

than 100 bytes

► http.request.uri matches “(gif)$” - Display all HTTP requests in which

the uri ends with “gif”

► dns.query.name == “www.google.com” - Display all DNS queries for

“www.google.com”


Follow TCP Stream


Follow TCP Stream

red - stuff you sent blue - stuff you get


Expert Info


Conversations


IOGraphs


Flow Graphs


HTTP Analysis


HTTP Analysis – Load Distribution


HTTP Analysis – Packet Counter


HTTP Analysis – Requests


And there is much much more which you should explore on

your own … Happy Exploring


Improving WireShark Performance

Don’t use capture filters

Increase your read buffer size

Don’t update the screen dynamically

Get a faster computer

Use a TAP

Don’t resolve names


Some Useful Information

Wireshark

http://www.wireshark.org

TCPDUMP MAN Page

http://www.tcpdump.org/tcpdump_man.html

IP Protocol

http://www.networksorcery.com/enp/protocol/ip.htm


Thank you

introduction to osi model and network analyzer...

Documents