CAPTURING AND ANALYZING ETHERNET FRAMES

With this activity,youwill useareal-life illustration of the encapsulation processthatdemonstrateshow application datais "packaged"byprotocols ofthevariouscommunicationlayers priortobeing sentoverthenetwork.This lab alsointroducesWireshark,a protocol analyzerusedduringthis course.

BACKGROUND

Thesecondmoduleofthis courseaddressestheconceptoflayered communicationmodel,encapsulationandpeertopeercommunication.Using a simple httpsession,this lab demonstrates_how application datais segmented, than"labeled"bythevariousprotocols oftheTCP/IP protocol stacktotravelacrossthe networkfromasourcetoa destination.

REQUIREMENTS

To performthis lab,youneedWiresharkinstalled onyourPC (download availablefromhttps://www.wireshark.org/download.html andaweb browser. Answer all questions by entering the responses to the best of your knowledge in the red fields.

In this assignment it would be best to disable IPv6 temporarily. Further information will be provided in the class. You may verify whether you use IPv6 or not, by going to the following address:

https://www.whatismyip.com/

Note that few ISP now assign IPv6 addresses to their clients.

STEP1-CAPTURE SETUP

1. Makesure *not*touse the VPNduring this exercise. It is recommended that disabled IPv6 temporarily.
2. Open a terminal (command line on windows) and type the following command:

ping -4 httpbin.org

The above command should display the IP address of server. Hit Ctrl+C to stop.

Write down the IP address in here:Server's IP Address

1. StartWiresharkandselectOptions undertheCapturemenu.
2. In the new window, click on "Manage Interfaces" and select only the interface used on your computer for Internet access. Click OK.
3. IntheCapture Interfacewindow,mouse-overtheactivenetworkinterface, locate and writedown theIPV4address in the followingfield. The IPv4 address is in the format 999.999.999.999. Your IP V4 Address.
4. The"Enable promiscuousmode on all interfaces"option allows youtocapture all packetstravelingonthesharedsegment.Forthis lab,deselectthis modesoonlythepacketssentspecifically fromortoyourcomputerwill becaptured. Close the Option window.
5. Inthecapture filterfield enterthefollowing information:

• host<>

This filter indicates thatyouwanttocapturepacketsgoing toandcoming fromahostwith thespecifiedIPaddress,in this caseaweb server.

1. Click onthe blue shark finin the top menu to Startthe capture,anewwindow should open.

STEP2-BROWSERSETUP

1. Go to http://httpbin.org/.

Make sure you use the "http" prefix. If for some reason you don't see any HTTP frame (see question 11), make sure you delete your browser's cache and cookies, close your browser, and open a new one, and try the full address including the HTTP prefix.

1. Go backtotheWiresharkwindow. The resultsofthecapture will appear.Click onthe red square icontoterminatethecapture session.

If it doesn't work

If the capture didn't work, review your capture settings, then clearyourcachetoremove thehttpfile alreadyonyourPC and try the entire procedure again.

STEP3-CAPTURE ANALYSIS

FRAMETYPES

1. How many frames did you captureEnter your answer here?
2. How many framescontain HTTP data?Enter your answer here.

FRAMESTRUCTURE

1. Selecttheframecontaining"HTTP/1.1 200 OK"in theinfofield[1]. right-click onit andselectShow packet in new window.
2. Observethedisplayed sections.Youcanclick onthearrow signs toexpand eachfield.Readthefollowing points andfill theblankswith the appropriateinformation.
3. Thefirstsectioncalled Frame[#] is asummaryoftheframecreatedby Wireshark.This informationdoesnottraveloverthenetwork.Neither doesanyinformationappearingonlines startingwith an arrowsign.
4. Thesecondsectioncontainsinformationrelevanttothe Enter text layeroftheOSImodelandtothe Enter text layeroftheTCP/IP suite.
5. Thethird sectioncontainsinformationrelevanttothe Enter text layeroftheOSImodelandtothe Enter text layeroftheTCP/IP suite.
6. Thefourthsectioncontainsinformationrelevanttothe Enter text layeroftheOSImodelandtothe Enter text layeroftheTCP/IP suite.
7. Thefifthsectioncontainsinformationrelevanttotheupperthreelayersof theOSImodel Enter text, Enter text and Enter text andtothe Enter textlayeroftheTCP/IP suite.

FRAMECONTENT(OSILAYER2)

1. Click onthearrow sign toexpandthesecondsectionoftheframe(Ethernet II).Writedown thetwo addresses:Address 1andAddress 2 (Use the numerical value).
2. Whataretheseaddressescalled?Address type.
3. Whatnumeralsystemdoesit use?Numerical system.
4. Whichphysical devices[2]dotheycorrespondto?Device 1 andDevice 2.
5. Whichlayer 2 standard is being used?Standard name.
6. Closethesectionbyclicking onthearrow sign.

PACKET CONTENT(OSILAYER3)

1. Click onthearrow sign toexpandthethird sectionoftheframe(Internet protocol).Writedown thetwo addresses:Address 1and Address 2.
2. Whatare theseaddresses called? Address type.
3. Whichdevices¹dotheycorrespondto? Device 1and Device 2.
4. Whichtransport protocol is the data intended to? Protocol name
5. Closethesectionbyclicking onthearrow sign

SEGMENTCONTENT(OSILAYER4)

1. Click onthearrow sign toexpandthefourthsectionoftheframe(TransmissionControl protocol).
2. Writedown thetwo addresses: Address 1 and Address 2.
3. Whatare theseaddresses called? Address type
4. Whichapplication is the datacoming from?Application name
5. Whatis the size ofthe dataportion of this segment?Data size
6. Closethesectionbyclicking onthearrow sign andselectthelast frameof this session.
7. Whatis the size ofthe dataportion of this segment?Data size

APPLICATIONDATA(OSILAYERS5,6AND7)

Close the Packet capture window and go back to the main capture page. Using the same frame:

1. Click onthesectioncalled "HypertextTransferProtocol".This section containshtmlmeta-data
2. Inthebottomwindow, highlight thetext"HTTP/1.1.
3. Whatis the correspondinghexadecimalvalueofthelettersHTTP. Enter value here
4. Right-click on the same value and select "Show bytes as bits". Whatis thebinaryvalueofthelettersHTTP. Enter value here

YoucanuseanASCIItableforhelp(http://www.asciitable.com).

STEP 4 - SUMMARY

List all the addressesappearing in:

1. TheEthernetheader:Enter text
2. TheNetworkheader:Enter text
3. TheTransportheader:Enter text

For each layer, you should indicate the source and destination addresses by type as well as the destination protocol.

STEP 5 - HTTPS

In item 9, you used http. In this step, we want to try the https instead.

Repeat the above exercise, by typing the following address in your browser:

• https://httpbin.org/.

Go to Wireshark and observe the new frames.

1. Can you find the frame corresponding to the step 13?Enter text
2. Why do you think you do not get a similar result?Enter text

[1] In case HTTP/1.1 200 OK is not found, you may look for "HTTP/1.1 304 Not Modified" or similar frames. The format us HTTP/1.1 followed by a 3-digit code followed by a text message.

[2] PC, hub, switch, router, server.