Assignment 3: Wireshark Packet Capture, Analysis,

and Reporting

Full marks: 20/100

(Word limit: Not less than 1000)

A Brief User Guide:

Wireshark

If you find yourself troubleshooting network issues, and you have to

inspect individual packets, you need to use Wireshark. Wireshark is the de
facto, go-to, you-need-to-know-how-to-use, application to capture and
investigate network traffic.

And because Wireshark is the predominant tool for this job, let’s go over
some application basics, such as where you can download Wireshark and
how to capture network packets.

 What is Wireshark?

 When should Wireshark be used?

 How to download Wireshark

 Data packets on Wireshark

 Analysing data packets on Wireshark

What is Wireshark?
Wireshark is an open-source network protocol analysis software program,
widely considered the industry standard. A global organization of network
specialists and software developers supports Wireshark and continues to
make updates for new network technologies and encryption methods.

Government agencies, corporations, non-profits, and educational

institutions use Wireshark for troubleshooting and teaching purposes.
There truly isn’t a better way to learn low-level networking than to look at
traffic under the Wireshark microscope.

You should only use Wireshark on networks where you have permission to
inspect network packets. Using Wireshark to look at packets without
permission is illegal.

How does Wireshark work?

Wireshark is a packet sniffer and analysis tool. It captures network traffic

from ethernet, Bluetooth, wireless (IEEE.802.11), token ring, and frame
relay connections, among others, and stores that data for offline analysis.

Editor’s Note: A “packet” is a single message from any network protocol

(e.g., TCP, DNS, etc.).

Editor’s Note 2: LAN traffic is in broadcast mode, meaning a single

computer with Wireshark can see traffic between two other computers. To
see traffic to an external site, you need to capture the packets on the
local computer.

Wireshark allows you to filter the log before the capture starts or during
analysis, so you can narrow down and zero in on what you’re looking for in
the network trace. For example, you can set a filter to see TCP traffic
between two IP addresses, or you can set it only to show you the packets
sent from one computer. The filters in Wireshark are one of the primary
reasons it has become the standard tool for packet analysis.

When should Wireshark be used?

Wireshark can be used to understand how communication takes place
across a network and to analyze what went wrong when an issue in
communication arises.

Wireshark helps:

 Network administrators troubleshoot problems across a network

 Security engineers examine security issues across a network

 QA engineers verify applications

 Developers debug protocol implementations

 Network users learn about a specific protocol

When shouldn’t Wireshark be used?

Wireshark can help troubleshoot many network issues, and it can be used
as an educational tool. However, Wireshark cannot:

 Help a user who doesn’t understand network

protocols: Users must first know how a network operates in order
to use Wireshark.

 Grab traffic from locations other than your local computer

and the system it talks to:Wireshark cannot grab traffic from all
of the other systems on a network.

 Notify you of alerts: The closest Wireshark can do is apply color-

coding and show malformed packets.

How to download Wireshark

Downloading and installing Wireshark is easy. Step one is to check the
official Wireshark download page for the operating system you need. The
installation is simple, and the basic version of Wireshark is free.

Wireshark for Windows

Wireshark comes in two options for Windows: 32-bit and 64-bit. Pick the
correct version for your OS; the current release is 3.0.3 as of this writing.

Wireshark for Mac

Wireshark is available on Mac as a Homebrew install.

To install Homebrew, you need to run this command at your Terminal

prompt:

/usr/bin/ruby -e "$(curl -fsSL

https://raw.githubusercontent.com/Homebrew/install/master/insta
ll)”

Once you have the Homebrew system in place, you can access several
open-source projects for your Mac. To install Wireshark, run this command
from the Terminal:

brew install wireshark

Homebrew will download and install Wireshark and any dependencies

needed to function correctly.
Wireshark for Linux

Installing Wireshark on Linux can be a little different depending on the

Linux distribution. If you aren’t running one of the following distros, please
double-check the commands.

Ubuntu

From a Terminal prompt, run these commands:

 sudo apt-get install wireshark

 sudo dpkg-reconfigure wireshark-common

 sudo adduser $USER wireshark

Those commands download and update the package, and add user
privileges to run Wireshark.

Kali Linux

Wireshark is probably already installed because it’s part of the basic

package. Check your menu under the option “Sniffing & Spoofing” to
verify.

Data packets on Wireshark

Now that we have Wireshark installed, let’s go over how to enable the
Wireshark packet sniffer and then analyze the network traffic.

Go beyond the wire with your security.

Wireshark will tell you what is happening in your network traffic, but it
won't tell you why.

Varonis adds context to network events, user actions and attacks. Want to
find out more?

Capturing data packets on Wireshark

When you open Wireshark, you see a screen showing you a list of all the
network connections you can monitor. You also have a capture filter field
to only capture the network traffic you want to see.
You can select one or more of the network interfaces using shift+left-click.
Once select the network interface, you can start the capture, and there
are several ways to do that.

Click the first button on the toolbar, titled “Start capturing

packets.”

You can select the menu item Capture -> Start.

Or you could use the keystroke Control+E.

During the capture, Wireshark will show you the packets captured
in real-time.

Once you have captured all the packets needed, use the same buttons or
menu options to stop the capture as you did to begin.

Best practice dictates stopping Wireshark’s packet capture before

analysis.

Analyzing data packets on Wireshark

Wireshark shows you three different panes for inspecting packet data. The
Packet List, the top pane, lists all the packets in the capture. When you
click on a packet, the other two panes change to show you the details
about the selected packet. You can also tell if the packet is part of a
conversation. Here are details about each column in the top pane:
  No.: This is the number order of the packet captured. The bracket
indicates that this packet is part of a conversation.

 Time: This column shows how long after you started the capture
this particular packet was captured. You can change this value in
the Settings menu to display a different option.

 Source: This is the address of the system that sent the packet.

 Destination: This is the address of the packet destination.

 Protocol: This is the type of packet. For example: TCP, DNS,

DHCPv6, or ARP.

 Length: This column shows you the packet’s length, measured in

bytes.

 Info: This column shows you more information about the packet
contents, which will vary depending on the type of packet.

Packet Details, the middle pane, shows you as much readable information
about the packet as possible, depending on the packet type. You can
right-click and create filters based on the highlighted text in this field.

Assignment Tasks: Wireshark Packet Analysis

and Reporting
TASK A: Matching DNS Query with Response

1. Matching DNS query with response:

Marks: 3/20
Go to the site: www.aapoly.net.au and capture some
packets.
a. Identify Source and DNS server IP address, Type of IP
address(s), TCP/IP protocol used, Source and DNS
server port numbers, Transaction ID, Nos. of
questions, the question(s) asked, IP version Internet
Address, Name length, Label count in your query.
 b. Type of IP address(s), TCP/IP protocol used,
Transaction ID, Nos. of answer(s), Answer(s) replied,
IP version Internet Address, Name length, Label count
in the response, IP address of the destination and
TTL.
c. Identify the TCP/IP three-way-handshake between the
source and destination.

2. Identify failed DNS request:

Marks: 2/20
Go to a random domain, capture the packets, and identify
a DNS request that failed. Identify type of IP address(s) in
the query.

TASK B: Identifying Hosts and Users in Your Company

Network: Marks: 10/20

When a host within an organisation’s network is infected or

compromised, network team need to promptly identify the
affected host and users. Wireshark is an intuitive tool to
serve the purpose. In this task, you need to download 3
password protected pcap files from the GitHub repository
https://github.com/moislam1955/Wireshark-
Assignment. Use password “moislam2024” to open these
files and investigate the following pcap files sequentially:
a. Open the sample-capture-1.pcap and identify the
infected host name(s) from the DHCP traffic. Provide the
relevant annotated screenshots along with
thedescription how you perform this identification.
b. Open the sample-capture-2.pcap and identify the
infected host(s) from NetBIOS Name Service traffic.
Provide the relevant annotated screenshots along with
the description how you perform this identification.
c. Open the sample-capture-3.pcap and identify the
device model(s) and operating system (OS) from HTTP
traffic in the infected host(s). Provide the relevant
annotated screenshots along with the description how
you perform this identification.
d. Open the sample-capture-3.pcap and identify users
in an Active Directory environment in the infected
host(s). Provide the relevant annotated screenshots
 along with the description how you perform this
identification.

Based on your overall analysis put a summary of your

findings in the form of a comment within the captured file.

Finally, produce a complete packet analysis report and send to

your Network Manager to take necessary action at his/her end.

TASK C: Analyse, Investigate, and Report Generation

Mark 5/20

To accomplish this task, you need to download the capture file

sample-capture-4.pcapng from the same GitHub repository
that you have used in your TASK B. This is also a password
protected file. You need to use the same password as before.
The tasks you need to accomplish includes among others;
investigation and identification of the network activities in the
following frames and add comments against the corresponding
frame. In addition, they need to summarise their findings
against these frames and add this summary comments in the
sample capture file within the Wireshark platform.

 Frame 3:
 Frame 5:
 Frame 29:
 Frame 46:
 Frame 48:
 Frame 64:
 Frame 79:
 Frame 126 - 130:

After completion of the above investigation, you need to

generate report within the Wireshark platform and copy this
entire report and paste it into a word file to submit the
assignment.

Submission Requirements:
Students must submit a word file based on the assignment
tasks they performed in TASK A TASK B and TASK C, which
shouldn’t be less than 1000 words.