201O International Conference on E-Health Networking, Digital Ecosystems and Technologies

Analysis and Application of Wireshark in TCP/IP Protocol Teaching

Shaoqiang Wang DongSheng Xu ShiLiang Yan

School of Computer Science and Department of Information Engineering & Technology Center
Technology Technology Southwest University of Science and
Changchun University Yulin University Technology
Changchun, China Yulin,China Mianyang, China
[email protected] [email protected] [email protected]

Abstract-TCP/IP is widely employed to interconnect of the standard features you would expect in a protocol
computing facilities in today's network environments, and it analyzer, and several features not seen in any other
is the most important content of networking elements study. product. Its open source license allows talented experts in
This paper introduces the functions and characteristics of the networking community to add enhancements. It runs
Wireshark, and expounds its analysis and application in on all popular computing platforms, including Unix,
TCP/IP protocol teaching by some specific examples. The Linux, and Windows [3]. Network administrators use it to
practice shows that good teaching result will be received with troubleshoot network problems; Network security
the aid of Wireshark and it is worth popularization and
engineers use it to examine security problems; Developers
application.
use it to debug protocol implementations; Students use it to
learn TCP/IP protocol. In the teaching process we can use
Keywords- Wireshark; TCPI/P; protocol; teaching
it to capture packets and analyze packet structure. MAC
frame, IP datagram, TCP packet segment, and other
I. INTRODUCTION content and transmission of PDU can be directly observed
TCP/IP (Transmission Control Protocol/Internet by students, which can get twice the result with half the
Protocol) is the basic communication language or protocol effort in TCP/IP protocols learning. The version of
of the Internet, and it is a set of protocols developed to Wireshark is 0.99.5 in this article.
allow cooperating computers to share resources across a
network. The TCP/IP protocol suite is made of five layers: Ill. TYPICAL CASES OF WIRESHARK IN ASSISTING

physical, data link, network, transport, and application. TCPIIP PROTOCOL TEACHING
The layers contain relatively independent protocols that Here we have two examples on how to use Wireshark
can be mixed and matched depending on the needs of the assistant with TCP/IP protocol teaching, the two section
system [1]. These network protocols are the important and are the important and difficult points of TCP/IP protocol
difficult points of TCP/IP protocol courses. If students teaching. Experimental devices are two hosts, host A and
don't understand the format and parameter of host B on LAN. IP address of host A is 192.168.0.10,
PDU(Protocol Data Unit), will couldn't understand fully physical address of host A is OO:02:3f:02:3b:ed, IP address
the principle and function of each layer in network. But the of host B is 192.168.0.20, physical address of host B is
content is abstract and boring, the teaching effect is not 00:11:11:02:59:e8. Host A is equipped with Wireshark, all
perfect sometimes. Wireshark is an excellent tool with operations are done on host A. In order to facilitate
analysis and measurement of network traffic monitoring. analysis, we can set filters, only snatch communication
To introduce Wireshark in the teaching process, on the one data between host A and B. We can also set up specific
hand an amount of information can be greatly enhanced in filter protocols further, such as snatch data only contain
the classroom to improve teaching efficiency, interaction ARP or ICMP protocol according to later experiments.
and interest, which will help students master the abstract
theories of TCP/IP protocol; The other hand, enable the A. Address Resolution Protocol (ARP)
students to master the Wireshark, which is often used as ARP is the acronym for Address Resolution Protocol, a
the analysis of monitoring tools in a network environment, network layer protocol used to convert an IP address into a
will be with great help to diagnose and solve network physical address. This section requires students to master
problems. the contents of ARP packet format, understand the
function and principle. To be able to capture ARP packets,
II. ABOUT WIRES HARK firstly execute the command "arp -d' to clear the arp
Wireshark is a free and open-source packet analyzer. It cache. Second, click the start capturing button in
is used for network troubleshooting, analysis, software and Wireshark toolbar, and then execute the command "ping
communications protocol development, and education. 192.168.0.20". The capture of ARP packets is shown in
Originally named Ethereal, in May 2006 the project was Figure l.
renamed Wireshark due to trademark issues [2]. It has all

978-1-4244-5517-11101$26.00 ©2010 IEEE EDT2010

269
 No. _I Source I Destination Iprotoco II Info
1 00 02·3f.02.3b ed ff"ffff ff ff ff ARP Who has 192.168.0.20? Tel1192 168 0 10
2 00:11:11:02:59:e8 00:02:3f:02:3b:ed ARP 192.168.0.20 is at 00:11:11:02:59:e8

I±l Frame 1 (42 bytes on wire, 42 bytes captured)

BEthernet II, Src: 00:02:3f:02:3b:ed (00:02:3f: 02:3b:ed), Dst: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
I±l Destinati 0 n: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
I±l Source: 00:02:3f:02:3b:ed (00:02:3f:02:3b:ed)
Type: ARP (Ox0806)
B Address Resolution Protocol (request)
Hardware type: Ethernet (Ox0001)
Protocol type: IP (Ox0800)
Hardware size: 6
Protocol size: 4
Opcode: request (Ox0001)
Sender MAC address: 00:02:3f:02:3b:ed (00:02:3f:02:3b:ed)
Sender IP address: 192.168.0.10 (192.168.0.10)
Target MAC address: 00:00:00:00:00:00 (00:00:00:00:00:00)
Target IP address: 192.168.0.20 (192.168.0.20)

Figure 1. ARP Packet

Now, we analyze the captured data by Figure 1, the Protocol size of 4 means that the length of logical address
first line(No.1) is an ARP request packet. Host A wants to accounts for 4 bytes. Opcode of request(OxOOO1) presents
find the physical address of host B on the LAN, it sends an that the type of the packet is ARP request. Sender MAC
ARP request packet. The packet includes the physical and address is 00:02:3f:02:3b:ed. Sender IP address is
IP address of the sender (host A) and the IP address of the 192.168.0.10. Target MAC address is 00:00:00:00:00:00,
receiver (host B). Because host A does not know the this field is all 0 because the sender does not know the
physical address of host B, the request is broadcast over physical address of the target. Target IP address is
the LAN, so that all the hosts on the LAN will receive the 192.168.0.20. By analyzing with the captured data,
request. The second line(No.2) is an ARP reply, every host students can see the format, content and transmission
on the LAN receives and processes the ARP request packet, process of ARP realistically, which is more effective
but only host B sends back an ARP reply. The reply packet especially compared with the traditional teaching in the
contains the IP and physical addresses of host B. The working principle understanding.
packet is unicast directly to host A using the physical
B. IP Datagram Format and Fragmentation
address received in the request packet. After receiving
ARP reply from host B, the mapping between IP address A datagram can ravel through different networks. Each
and the physical address of host B is written into ARP router decapsulates the IP datagram from the frame it
cache of host A. When host A communicate with host B receives, processes it, and then encapsulates it in another
the next time, it can find the physical address directly from frame. The format and size of the received frame depend
the cache instead of using broadcast to send the ARP on the protocol used by the physical network through
request packet. The above illustrates the working principle which the frame has just traveled. The format and size of
and analytical process of the ARP protocol. the sent frame depend on the protocol used by the physical
We can also view specific format and parameters of the network through which the frame is going to travel. Each
captured data packet through packet details. As shown in data link layer protocol has its own frame format. When a
Figure 1, there are 42 bytes in this frame. Destination datagram is encapsulated in a frame, the total size of the
address is ff:ff:ff:ff:ff:ff, Source address is datagram must be less than maximum transfer unit (MTU)
00:02:3f:02:3b:ed, it means that the frame is sent from [1]. This section requires students to master the contents of
host A to all the hosts on the LAN. Type (data type) of IP datagram format, understand the process of IP datagram
Ox0806 indicates that the data type of the frame is ARP. fragmentation. Click the start capturing button in
Hardware type of Ox0001 means that the type of the Wireshark toolbar, then execute the command ping
network is standard Ethernet. Protocol type of Ox0800 "192.168.0.20 -I 3000", some of the data packets are
means IPv4 protocol. Hardware size of 6 means that the captured which is shown in Figure 2.
length of the physical address accounts for 6 bytes.

270
 No 1 Source
. • 1 Destination Iprotocoll Info
1 192.168.0.10 192.168.0.20 IP Fragmented IP protocol (proto=IC MP Ox01, off=O)
2 192.168.0.10 192 168 0.20 IP Fragmented IP protocol (proto=IC MP Ox01, off=1480)
3 192.168.0.10 192.168.0.20 IC MP Echo (ping) request
4 192.168.0.20 192.168.0.10 IP Fragmented IP protocol (proto=IC MP Ox01, off=O)
5 192.168.0.20 192.168.0.10 IP Fragmented IP protocol (proto=IC MP Ox01, off=1480)
6 192.168.0.20 192.168.0.10 IC MP Echo (ping) reply

I±l Frame 2 (1514 bytes on wire, 1514 bytes captured)

I±l Ethernet II, Src: 00:02:3f:02:3b:ed (00:02:3f:02:3b:ed), Dst: 00:11 :11:02:59:e8 (00:11 :11:02:59:e8)
EJ Internet Protocol, Src: 192.168.0.10 (192.168.0.10), Dst: 192.168.0.20 (192.168.0.20)
Version: 4
Header length: 20 bytes
I±l Differentiated Services Field: OxOO (DSCP OxOO: Default; ECN: OxOO)
Total Length: 1500
Identification: Oxebb2 (60338)
EJ Flags: Ox02 (More Fragments)
0.. . = Reserved bit: Not set
.0 .
. = Dont fragment: Not set
..1. = More fragments: Set
Fragment offset: 1480
Time to live: 64
Protocol: ICMP (Ox01)
I±l Header checksum: Oxe746 [correct)
Source: 192.168.0.10 (192.168.0.10)
Destination: 192.168.0.20 (192.168 0.20)
Reassembled IP in frame: 3
Data (1480 bytes)

Figure 2. IP Datagram Format and Fragmentation

With the use of the command "ping 192.168.0.20 -I fragment with respect to the whole datagram is 1480 bytes,
3000", ICMP packet carries 3000 bytes of data, coupled that is the former fragment contains the first 1480 bytes
with ICMP header and IP header, it has been over the data of the higher protocol; Time to live of 64 means the IP
MTU of data link layer protocol in Ethernet. Therefore, the datagram's lifetime is 64 hops; Protocol of ICMP(OxOl)
excessive datagram must be divided before the indicates that the higher level protocol that uses the
transmission on the network. We can see the IP datagram services of the IP layer is ICMP, this field specifies the
of the ICMP request and reply are divided into three final destination protocol is to which the IP datagram
fragment from Figure 2. Confined to the length of the should be delivered. Header checksum is the error
thesis, we only analyze the second fragment of the ICMP detection method used by most TCP/IP protocols, its value
request packet in the text. is Oxe746. Source of 192.168.0.10 and Destination of
Source MAC address is 00:02:3f:02:3b:ed, Destination 192.168.0.20 indicates that the IP datagram(or fragment) is
MAC address is 00:11:11:02:59:e8, it means that the frame sent from host A to host B. Data of 1480 indicates that the
is sent from host A to host B. Version of 4 means that the fragment carries 1480 bytes data of the higher layer. Test
version of the IP protocol is IPv4. Header length of 20, to ascertain discrepancies between the captured results and
means the header length of degree is 20 bytes. Total length IP fragmentation principle again, as ICMP carries 3000
of 1500 indicates that the IP datagram (or fragment) total bytes, coupled with 8 bytes of its header, the total bytes is
length is 1500 bytes. Identification of Oxebb2(60338) 3008, with the MTU of data link layer protocol in Ethernet
indicates that the IP datagram (or fragment) identification is 1500, then get rid of 20 bytes IP header, each fragment
is 60338. Flag segment as Flags is a three-bit field. The can only get 1480 bytes, the offset of the data in the
first bit is reserved. The second bit is called the do not original datagram measured in units of eight bytes. so 3008
fragment bit, its value is 0 means the datagram can be bytes are divided into three parts:1480, 1480, 48, then the
fragmented if necessary. The third bit is called the more length of the three datagram fragment should be 1500,
fragment bit, its value is 1 means the datagram is not the 1500, 68 after plusing 20 bytes of the IP header, that is
last fragment, there are more fragments after this one. consistent with the results of the captured data completely.
Fragment offset of 1480 shows the relative position of this

271
 IV. CONCLUSION REFERENCES

The application form of Wireshark is flexible and [ 1] Behrouz A.Forouzan, TCP/IP Protocol Suite [M], Third Edition.
Beijing: Tsinghua University, 2006.
diversified during the teaching. Practice has proved that,
the use of Wireshark during TCP/IP protocol teaching can [2] http://en.wikipedia.orgiwiki/Wireshark

improve the effort and make the abstract theoretical [3] http://www.ethereal.com/
knowledge emerge with direct and active examples. The [4] Xiren Xie, Computer network [M], 5th edition, Beijing: Electronic
Industry, 2008.
students have been interested in learning, and good
teaching effect has received considerable. Wireshark is [5] Tian Junsong, Huangfu Daen, "The Application of Ethereal in
<Network Protool> Teaching," Educaton Popularizer, 2008.9,
useful and should to be spread as a supplementary means
pp.63-64,54.
for TCP/IP protocol teaching.
[6] Huang Xiaoyan, "Network Protocol Analysis Based on Ethereal,"
Tropical Agricultural Engineering, Yol.33, No. 1, 2009.2, pp.42-45.

272