Wireshark 1
Wireshark 1
Experiment – 1
1. List up to IO different protocols that appear in the protocol column in the unfiltered packet
listing window.
1 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
2. How long did it take from when the HTTP GET message was sent until the HTTP OK reply was
received? (By default, the value of the Time column in the packet listing window is the
amount of time, in seconds, since Wireshark tracing began. To display the Time field in
timeof-day format, select the Wireshark View pull down menu, then select Time Display
Format, then select Time-of-day. For now you don’t need to understand HTTP GET and OK,
but reading the textbook may be helpful if you are curious on how they work.).
> 0.161 sec
2 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
3. What is the Internet address of the www.google.com? What is the Internet address of your
computer? Include a screenshot and describe where you got the data to answer this
question
4. Provide a screenshot showing http protocol only with Wireshark running on your computer.
5. How many packets did you capture (total of all protocols, not just HTTP)? Now, use display
filters to determine how many packets contain your ip address (hint: Use ip.addr instead of
the clumsy ip.src or ip.dst format). What is this filter you used? Now, reverse the filter to
3 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
determine how many packets don’t contain your ip address. See any problems here? If not,
you've already figured out the point of this question, so explain how you did so. If so, how
can this problem be fixed? What are the appropriate display filters to use? How does
Wireshark warn you of such a problem?
1. PACKETS:-18924
2. PACKETS :-6468/20054(32.3%)
3. PACKETS :-224/20170(1.1%)
Now, use display filters to determine how many packets contain your ip address. What is this filter
you used?
4 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
Now, reverse the filter to determine how many packets don’t contain your ip address.
6. Use your newly acquired Wireshark skills to capture the process when your browser loads
the front page of INI's website (i.e. http://www.ini.cmu.edu). How many packets did you
capture? Were all of them HTTP? How many HTTP requests did you make? Were all the
replies "200 OK"? Did you find anything else interesting? Please ensure you have examined
this packet capture in detail, using appropriate Wireshark functionality. Please include screen
captures where you think they are necessary.
5 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
How many HTTP requests did you make? Were all the replies "200 OK"? Did you find anything else
interesting?
1 request on device all were “200 ok” on wifi enabled devices,it was 301 moved Permanently.
6 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
7 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
8 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
9 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
8. What HTTP version is your browser running? What version of HTTP is the server running?
10 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
11 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
9. What is the status code and phrase returned from the server to your browser?
Status code: 200
Response Phrase: OK
10. What languages does your browser indicate to the server that it can accept? Which header
line is used to indicate this information?
12 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
11. When was the HTML-file, that you have retrieved, last modified at the server? Which header
line is used to indicate this information?
13 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
12. How many bytes of content (size of file) are returned to your browser? Which header line
is used to indicate this information?
13. We know that most web browsers perform object caching and thus perform the
conditional GET when retrieving HTTP objects. Before performing the steps below, make sure
that your browser’s cache is empty.
14 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
14. Start up your web browser, and make sure your browser’s cache is cleared.
15. Start up the Wireshark packet sniffer, and make sure that “http” is in the displayfilter, so
that only captured HTTP messages will be displayed in the packet-list pane.
16. Enter the following URL into your browser:
http://gaia.cs.umass.edu/wireshark-labs/HTTP-wireshark-file2.html Your browser should
display a very simple HTML file.
17. Quickly enter the same URL into your browser again (or simply select the refresh button
on your browser).
18. Stop Wireshark packet capture
19. Inspect the contents of the first HTTP GET request from your browser to the server. Is
there an “IF-MODIFIED-SINCE” header line in the HTTP GET message? Why or why not?
15 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
It is not present in first request because it loads the webpage for the first time, but for the next
time, it will try to check if the last requested webpage was modified and only load the new one if
some changes were detected.
20. Inspect the contents of the server response. Has the server explicitly returned the contents of the
file? How can you tell?
16 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
Yes, the server has returned the content of HTTP-wireshark-file2.html file which can be confirmed by
the Content-Type: text/html header.
21. Now inspect the contents of the second HTTP GET request from your browser to the server. Is
there an “IF-MODIFIED-SINCE:” header line in the HTTP GET message? If so, what information follows
the “IF-MODIFIED-SINCE:” header line?
It indicates that the server should return new file only if it was modified after the given date & time
which is 25th Feb 6:58 pm GMT in this case.
22. What is the HTTP status code and phrase returned from the server in response to this second
HTTP GET? Has the server explicitly returned the contents of the file? Explain.
17 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
23. How many HTTP GET request messages has your browser sent? Which packet in the trace
contains the request for the Bill of Rights?
24. Which packet in the trace contains the status code and phrase associated with the response to
the HTTP GET request? What is the status code and phrase in the response?
-> The following packet contains the response from gaia.cs.umass.edu to my local PC DESKTOP-
0UI17VP.LOCAL
The STATUS CODE is 200 and RESPONSE PHRASE is OK.
18 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
25. How many TCP segments are needed to carry the single HTTP response and the text of the Bill of
Rights? What is the number of bytes (of the text) in each segment?
19 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
Experiment – 2
1. Start up the Wireshark program (select an interface and press start to capture packets).
4. After your browser has displayed the http://https://svgu.ac.inpage, stop Wireshark packet capture
by selecting stop in the Wireshark capture window. This will cause the Wireshark capture window to
disappear and the main Wireshark window to display all packets captured since you began packet
capture, new window will appear:
20 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
5. Color Coding: You’ll probably see packets highlighted in green, blue, and black. Wireshark uses
colors to help you identify the types of traffic at a glance. By default, green is TCP traffic, dark blue is
DNS traffic, light blue is UDP traffic, and black identifies TCP packets with problems — for example,
they could have been delivered out-of-order.
->DNS
->TCP
->TCP(BLACK)
->UDP
21 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
6. You now have live packet data that contains all protocol messages exchanged between your
computer and other network entities! However, as you will notice the HTTP messages are not clearly
shown because there are many other packets included in the packet capture. Even though the only
action you took was to open your browser, there are many other programs in your computer that
communicate via the network in the background. To filter the connections to the ones we want to
focus on, we have to use the filtering functionality of Wireshark by typing “http” in the filtering field,
new window will appaer:
Notice that we now view only the packets that are of protocol HTTP. However, we also still do not
have the exact communication we want to focus on because using HTTP as a filter is not descriptive
enough to allow us to find our connection to http://www.gtu.ac.in. We need to be more precise if we
want to capture the correct set of packets.
22 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
7. To further filter packets in Wireshark, we need to use a more precise filter. By setting the
http.host==https://svgu.ac.in or http.host==www.facebook.com , we are restricting the view to
packets that have as an http host the www.gtu.ac.in website or www.facebook.comweb site. Notice
that we need two equal signs to perform the match “==” not just one. new screenshot will appear.
23 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
The HTTP GET method is one of the most commonly used methods in HTTP (Hypertext
Transfer Protocol) for requesting data from a server. When a client (like a browser) sends a
24 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
GET request, it asks the server to send back specific information. It doesn't modify the data
or have any side effects; it’s all about retrieving data.
GET / HTTP/1.1
HOST:gtu.ac.in
HTTP Response:-
Status Line: This includes the HTTP version, a status code, and a status message.
Headers: Headers provide metadata about the response, such as content type, caching instructions,
or server information.
25 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
Body: The actual content of the response, which can be HTML, JSON, an image, or any other type of
data, depending on the request. For a GET request for a webpage.
26 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
Experiment – 3
1. Count the total number of HTTP GET requests.
2. The first HTTP GET request was sent by the client to access the................. webpage
->HOST_ADDRESS :- 172.20.10.2
27 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
4. How much time elapsed between the first HTTP GET request from client and the HTTP
response (OK) from server?
28 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
5. Identify the source and destination ports used to transfer the first HTTP GET request.
6. Identify the client and server ip address in the first HTTP GET request?
7. Identify the client and server MAC address in the first HTTP GET request?
->CLIENT’S MAC ADDRESS :- 90-0F-0C-DA-87-35
->SERVER’S MAC ADRESS :- FE-9C-A7-A3-03-64
29 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
Experiment – 4
1. Use the filtering functionality of Wireshark by typing “dns” in the filtering field, new window
will appear:
2. Let’s try now to find out what are those packets contain by following one of the
conversations (also called network flows), select one of the packets and press the right
mouse button, you should see another screen appear:
30 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
3. Click on Follow UDP Stream, and then you will see another screen showing content gtu.ac.in
4. If we close this window and change the filter back to “http.host==www.gtu.ac.in” and then
follow a packet from the list of packets that match that filter, we should get the something
similar to the following screens. Note that we click on Follow TCP Stream this time.
31 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
5. Locate the DNS Query and Response message, Are they sent on UDP or TCP
-> Some are for UDP and others are for TCP
6. What is the destination port for the DNS query message ? What is the source port of DNS response
message?
32 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
The Source Port of DNS Response is also 53 (since it’s coming from the same server)
8. To what IP address is the DNS query message sent ? Is this the IP address of your default local
DNS server ? Use ipconfig to determine the IP address of your local DNS server. Are these
two IP address the same ?
33 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
8. Examine the DNS query message. What “Type” of DNS query is it? Does the query message
contain any “answers”?
It’s a type A Standard Query and it doesn’t contain any answers.
9. Examine the DNS response message. How many “answers” are provided? What do each of
these answers contain?
34 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
-> There are two answers, each one with a different IP address (3.108.72.164 and 3.108.0.139)
10. Consider the subsequent TCP SYN packet sent by your host. Does the destination IP address of
the SYN packet correspond to any of the IP addresses provided in the DNS response message?
-> Yes, the TCP SYN packet is sent to the first IP address that was received as DNS response message.
35 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
Experiment – 5
Start packet capture
Do an nslookup on www.sandesh.com
At Command prompt > Nslookup www.sandesh.com
Stop packet capture
Filter : ip.address== IP address of sandesh.com
We see from the screenshot that nslookup actually sent certain number of DNS queries and received
certain number of DNS responses too. Ignose the first few sets of queries/response, as they are
specific to nslookup and are not normally generated by standard Internet applications. You should
instead focus on the last query and response message. And find:
36 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
1. What is the destination port for the DNS query message ? What is the source port of of DNS
response message?
-> Destination port of DNS query message is 53 and source port of DNS response is also 53 (since
they represent the same server)
37 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
2. To what IP address is the DNS query message sent ? Is this the IP address of your default local
DNS server ?
-> It’s sent to fe80:fc9c:a7ff:fea3:364 which is the IP address of my local router functioning as a
DNS server.
38 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
3. Examine the DNS query message. What “Type” of DNS query is it? Does the query message
contain any “answers”?
-> It is an AAAA type DNS query. It doesn’t contains any answers since it’s a request to the server.
4. Examine the DNS response message. How many “answers” are provided? What does each of these
answers contain?
-> There are 3 answers provided by the DNS server. Each answer contains a unique IP address
corresponding to each server.
39 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
-> No response was sent from Sandesh.com’s server directly, the NS query was resolved locally by my
local DNS server (my router).
40 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
1. To what IP address is the DNS query message sent? Is this the IP address of your default local DNS
server?
2. Examine the DNS query message. What “Type” of DNS query is it? Does the query message
contain any “answers”?
41 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
3. Examine the DNS response message. What does sandesh.com name servers response message
provide? Does this response message also provide the IP addresses of the Sandesh name servers?
● Name: sandesh.com
● Type: SOA (6) (Start Of a zone of Authority)
● Class: IN (0x0001)
● Time to live: 1800 (30 minutes)
● Data length: 49
● Primary name server: ernest.ns.cloudflare.com (Master Name Server – MNAME)
● Responsible authority's mailbox: dns.cloudflare.com
● Serial Number: 2365947894
● Refresh Interval: 10000 (2 hours, 46 minutes, 40 seconds)
● Retry Interval: 2400 (40 minutes)
● Expire limit: 604800 (7 days)
● Minimum TTL: 1800 (30 minutes)
42 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
Experiment – 6
1. Start up your favorite web browser, which will display your selected homepage.
2. If you are using a proxy (especially a host-based one), disable it if possible to examine uncached
network traffic.
3. Also better to clear browser cache, cookies if you have previously displayed this page.
43 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
4. You may need to disable anti-virus protection software before your own IP address will show up in
captured data.
5. Start up the Wireshark software, select the Capture pull down menu and select Interfaces.
6. Here we will be using nslookup tool, which is available in most Linux/Unix and Microsoft platforms
today.
7. nslookup tool allows the host running the tool to query any specified DNS server for a DNS record.
8. The queried DNS server can be a root DNS server, a top-level-domain DNS server, an authoritative
DNS server, or an intermediate DNS server. To accomplish this task, nslookup sends a DNS query to
the specified DNS server, receives a DNS reply from that same DNS server, and displays the result.
10. Command Run 2 : nslookup –type =NS www.facebook.com or type nslookup –type =NS
www.gtu.ac.in, here provided the option “-type=NS” and the domain “facebook.com” or “gtu.ac.in”.
This causes nslookup to send a query for a type-NS record to the default local DNS server. In words,
the query is saying, “please send me the host names of the authoritative DNS for facebook.com,
gtu.ac.in
44 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
11. ipconfig (for Windows) and ifconfig (for Linux/Unix) command show your current TCP/IP
information, including your address, DNS server addresses, adapter type and so on.
45 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
46 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
13. we learned that a host can cache DNS records it recently obtained. To see these cached records,
after the prompt C:\> provide the following command: ipconfig /displaydns Each entry shows the
remaining Time to Live (TTL) in seconds. To clear the cache, enter ipconfig /flushdns Flushing the DNS
cache clears all entries and reloads the entries from the hosts file.
47 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
Experiment – 7
1. filter packets in Wireshark http.host==www.facebook.com
2. Now, we can try another protocol. Let’s use Domain Name System (DNS) protocol as an example
here.
Now that we are familiar with nslookup and ipconfig, we’re ready to get down to some serious
business.
Let’s first capture the DNS packets that are generated by ordinary Web-surfing activity.
48 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
● Open your browser and empty your browser cache. (With Internet Explorer, go to Tools
menu and select Internet Options; then in the General tab select Delete Files.)
● Open Wireshark and enter “ip.addr == your_IP_address” e.g. ip.addr==192.168.0.81 into the
filter, where you obtain your_IP_address with ipconfig. This filter removes all packets that
neither originate nor are destined to your host.
4. Locate the DNS query and response messages. Are then sent over UDP or TCP?
-> DNS Query and Response messages are sent over TCP
5. What is the destination port for the DNS query message? What is the source port of DNS response
message?
-> Destination port for DNS query message is 53. Source port of DNS response is 53.
49 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
6. To what IP address is the DNS query message sent? Use ipconfig to determine the IP address of
your local DNS server. Are these two IP addresses the same?
-> DNS Query message is sent to 172.20.10.1 which is the same address as that of my local DNS
server.
50 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
7. Examine the DNS query message. What “Type” of DNS query is it? Does the query message
contain any “answers”?
-> The Type of DNS query was “AAAA”. The query message doesn’t contain any “answers” since it’s a
request to the server.
8. Examine the DNS response message. How many “answers” are provided? What do each of these
answers contain?
-> There are 2 answers provided. Each answer contains a unique IP address pointing to the server.
51 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
52 | Page
Computer Networks (2321101124) SVG University, MCA Department
Name: Bhavesh Prajapati Enrollment No: 24CI2110074
53 | Page
Computer Networks (2321101124) SVG University, MCA Department