Laboratory work №13-14. Creation of a simple network configuration.

IP addressing. Network monitoring. Traffic analysis. Use of sniffers for

analysis of network packets

Methodological guidelines for performing the work

Creation of IP version 4 network.

The interface of Cisco Packet Tracer program is given in figure 7.1.

Figure 7.1 – Cisco Packet Tracer program interface

1. Main menu of the program.

2. Toolbar duplicates several menu items.
3. Switch between logical and physical organization.
4. One more toolbar contains instruments of highlighting, deleting, replacing,
scaling of objects and formation of arbitrary packets.
5. Switch between the real mode (Real-Time) and mode of simulation.
6. Panel with groups of end devices and communication lines.
7. End devices are various switches, nodes, access points, conductors.
8. Panel of creating user scenarios.
9. Work space.
It is necessary to build IP version 4 network of the protocol (figure 7.2), using
the following devices:
 Cisco router 2811 - 2 pieces;
 Cisco switch 2950-24 – 2 pieces;
 server – 1 piece;
 personal computer – 6 pieces.
To place the device, it is necessary to select it from the menu and drag onto
the principal panel (figure 7.3).
Figure 7.2 – IPv4 network topology

Figure 7.3 – Choice of the device

 The majority of devices in Packet Tracer have expansion units necessary for
connection of additional ports. Adding modules is carried out in a setup panel. In
case of connection of a new module, the device should be switched-off from the
power supply network (figure 7.4).

Figure 7.4 – Addition of extension modules

To connect the devices located on Connections panel (figure 7.5) it is

necessary to select suitable cables among themselves. Then it is necessary to right-
click on one of the devices and select a port of connection. Perform similar
operations for all devices.
To connect devices of one category it is necessary to use crossover cable, in
our case it is Serial DTE. In case of connection of devices from different categories
– Copper Straight-Through (cable of direct connection).
Serial interfaces are necessary to connect the router to WAN (wide area
networks).
The FastEthernet0/0 interface is set up to connect the device to a local area
network, i.e. FastEthernet0/0 is the Inside interface, and FastEthernet0/1 is the
Outside interface for connection to an external network.
The command «no shutdown» turns on interfaces.
For configuring routers, it is necessary to select the tab CLI (figure 7.6).
Figure 7.5 – Establishing communications between devices

Figure 7.6 – Router Configuration Window

 When configuring one can select an option of the range of networks,
according to table 7.1.

Table 7.1 – Basic data

IP-address
3 octet 4 octet
Variant 1 octet 2 octet (ID penultimate (ID last figure)
figure)
0 192 85
1 168 75
2 159 62
3 207 15
4 198 95
5 168 125
6 112 198
7 158 168
8 165 125
9 203 21

Control of router 1:

Router# en
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router (config) #interface fastEthernet 0/0
Router (config-if) #ip address 192.168.1.1 255.255.255.0
Router (config-if) #no shutdown
Router (config-if) #exit

Router (config) #interface serial 1/0

Router (config-if) #ip address 192.168.20.1 255.255.255.0
Router (config-if) #no shutdown
Router#wr me
Router#wr memory

Control of router 2:

Router#
Router>en
Router#conf t
Router (config) #interface fa0/0
Router (config-if) #ip address 192.168.2.1 255.255.255.0
Router (config-if) #no shutdown
Router (config-if) #exit
 Router (config) #interface serial 1/0
Router (config-if) #ip address 192.168.20.2 255.255.255.0
Router (config-if) #clock rate 64000
Router (config-if) #no shutdown
Router#wr

In case of simulation of the first network, we will appropriate addressing

between PC manually. For this purpose, it is necessary to output the menu of
configuration, having clicked with a mouse on PC. To select «Static» manually to
enter the IP address, a mask of network and the IP address of the router (Default
Gateway) (figure 7.7).

Figure 7.7 – РС Settings

Also in the «Config» tab, it is necessary to fill the network router IP address
(figure 7.8).
 Figure 7.8 – РС configuration

In case of simulation of the second network, it is necessary to use DHCP

server.
DHCP is a network protocol allowing computers to receive automatically the
IP address and other parameters necessary for TCP/IP net surfing. This protocol
works according to the client-server model. For an automatic configuration, the
computer client at a stage of a configuration of the network device addresses to so-
called DHCP server and receives from it necessary parameters. It is for the
convenience of distribution of IP addresses on a network. Server configuration is
shown in figure 7.9.
 Figure 7.9 – DHCP server configuration

1. Set up static routing between routers without using any protocols directly
connected to each other and by means of «ip route» command to subnets; remove
this command.
2. Check the network level by means of «show ip route» command
(verification of the presence of record about scheduled destination network in a
routing table).
3. By means of «show run» command show the current status of ports of the
router and also the type of connection and connection protocol.
On IP configuration 4 of a computer it is seen that the IP address was
received automatically, due to DHCP protocol (figure 7.10).
It is enough to set up on the router the way to a subnet and computers will
automatically configure IP addresses, as shown in figure 7.11.
 Figure 7.10 – PC4 Configuration

Figure 7.11 – PC8 IP configuration

 In real time, the network always works irrespective of actions of the user.
Configuring a network is carried out on-line.

Figure 7.12 – Functioning of the network in real time

In the mode of simulation, it is possible to watch the networks, work slower,

studying the ways on which packets are sent. When switching in the mode of
simulation the special panel will appear. You can graphically view the distribution
of packets on a network, having pressed the Add Simple PDU button. There is a
possibility of monitoring of speed of simulation with use of the Speed Slider button.
It is also possible to view the previous events, having pressed the button Back.
 Figure 7.13 – Modeling mode (simulations)

During simulation it is possible to click on the sent packet and obtain the
detailed information about it.

Figure 7.14 – Information on a package

 Operation in Wireshark program.
To start the program it is necessary to click: Start-up - Programs - Wireshark
or two times to left-click on a program label on a desktop.
The initial interface of the program is shown in Figure 7.15 and its
description is given in Table 7.2.

Figure 7.15 – Initial interface of the program Table

7.2 – Description of functions of program area

Highlighted Description and functions
area
1 Button of active network adapters from which the capture of traffic
is possible. The list has the form of an interactive table
2 List of active network interfaces. Pressing any interface from the
list will immediately start the process of traffic capture
3 Button of settings of process of traffic capture
4 Button allowing to load into the program the file taken earlier and
saved with the report on the taken network traffic

Capture of network traffic.

Capture traffic through the command Capture – Options. The following
options for capturing packets are set in the opened dialog box:
a) register the place of saving future captured file in Capture file (s) -> File;
 b) set the size of the captured file, ticked the function Use multiple files ->,
select the size;
c) if necessary, set restriction for the size of the captured file in the field of
Stop Capture, having restricted by quantity of packets, byte, minutes.
Capture traffic through the command Capture - Interfaces. Select an active
interface from the opened dialog box or necessary for you if there are several active
ones (figure 7.16).

Figure 7.16 – Capture - Interfaces window

Filtering packets.
After selecting the interface and capturing traffic, the packet capture window
is displayed (figure 7.17), the description of fields is given in table.

Figure 7.17 – Window of captured packets

 Columns of field 3 show:
- No. – number of a packet in the file of capture;
- Time – temporal mark of a packet;
- Source –address (from where the packet came);
- Destination – destination address (where the packet will go to);
- Protocol –name of the protocol in reduced version;
- Info – additional information about the contents of the packet.

Table 7.3 – Description of capture window fields

Selected Description
area
1 Program menu and toolbar of the most often used program
functions
2 Filter the captured packets
3 Summary list box for all captured PDUs (Packet list)
4 Information field for displaying detailed information about a
specific selected PDU (Packet Details)
5 Field for displaying the data highlighted in the information field
in hex and text form (Packet Bytes)

Packet filtering by certain protocols.

The filter can be used both for capturing traffic in real time, and when
analyzing it, stored in the capture file. To apply the filter it is necessary to:
1) enter the filter in the input field.
2) press the button «Apply».
The field for entering the filter may change color depending on what was
typed:
 green means everything is in order;
 red an error has been made;
 yellow an unexpected result is obtained, because there are other options for
writing a filter (for example, it is possible to write ip.dst! = 8.8.8.8 or !ip.dst ==
8.8.8.8, the second option is more preferable).
Let us filter on TCP protocols (figure 7.18), Similarly, we will filter on
HTTP, DNS.
 Figure 7.18 – Packet filtration of TCP protocol

Saving the filter at the toolbar.

To further use the filter, you must press the «Save» button in the filter field,
then enter an arbitrary name and, after clicking on the «OK» button, the filter
appears as a button on the toolbar (figure 7.19).

Figure 7.19 – Window of filter saving

To create a filter for certain parameters of the packet, you must right-click on
the selected option and apply it.
Retrieving information from captured packets.
From locked files it is necessary to make filtering on HTTP protocol packets
for extraction of files or pictures.
To retrieve files or images from the captured files, you need to filter for
packets of HTTP Protocol.
 Then go to File – Export Objects – HTTP menu to retrieve information. A
window will appear that will show all captured http objects-text files, pictures, etc.
(figure 7.20).

Figure 7.20 – List of captured files

In order to retrieve any file from this list, simply highlight it and click «Save
As»
. The drawing was extracted without any problems. In the same way, you can
extract and stream video / audio.
In order to view quickly the transmitted data within a certain session, use the
menu command Analyze - Follow TCP Stream. After executing the command, a
dialog box appears in which different colors will display both the client's requests
and the server's responses.
The «Entire conversation» button with a drop-down list allows you to display
both parties involved in the exchange, or only one of them. The dialog box allows
you to display data in various formats (ASCII, EBCDIC, Hex Dump, C Arrays,
Raw) and save them to a file. When frames with a file are detected in a session, you
can display only the stream of the corresponding direction, select the desired
format, and save it on the disk.
Statistics on captured packets in graphic form.
Wireshark can output the information in graphical mode, which facilitates its
perception. By going to the Statistics-Graphs tool menu, you can select five filters
to compare the files by title with the help of highlighting with different colors in
figure 7.21.
 Figure 7.21 – Graph of dependence of traffic different types

7.4 Control questions

1. What command is used to configure devices in the program?

2. How to change the transmission rate of packets?
3. What is a packet?
4. What is a router?
5. How to configure routing?
6. What is IP protocol? Advantages and shortcomings of IP protocol?
7. How to retrieve a picture from captured packets?
8. How to output the diagram of traffic dependence?
9. How to save the filter on a panel?
10. How to realize packet filtering?