Hands$-$On Project $2-1$: Using Wireshark with a Hub

Time Required: $20$ minutes

Objective: Use the Wireshark protocol analyzer on a computer connected to other computers via a hub to see that all data is repeated to all stations.

Required Tools and Equipment: Three lab computers, three patch cables, and a hub. Review the lab setup instructions in "Before You Begin" for more information on lab equipment.

Description: In this project, you run Wireshark on a group of computers connected via a hub. This project shows that a hub repeats all data to all stations so that Wireshark can capture packets generated by all stations. In the next project, you compare this behavior with a switch.

This project requires at least three computers connected to a hub, with at least one computer running Wireshark. It's probably best done in groups. The steps in this project assume three computers are connected to the hub and labeled Computer$1,$ Computer$2,$ and Computer$3.$ Wireshark must be installed on Computer$1,$ but it can be installed on all computers. It's preferable that the computers aren't attached to the classroom network and don't have access to the Internet.

Connect three lab computers to a hub with patch cables. Make sure the device is a hub, not a switch.

Turn on the computers and log on as NetAdmin. Open a command prompt window on each computer. $($In Windows $10,$ right$-$click Start and click Command Prompt.$)$ On each computer, type ipconfig and press Enter to display its IP address configuration. Write down these IPv$4$ addresses so that you know each computer's address:

Computer$1$:

Computer$2$:

Computer$3$:

To verify connectivity, type ping IPaddress from each computer and press Enter $($replacing IPaddress with another computer's IP address$).$ Repeat this step until you have successfully pinged each computer from the other computers.

If the pings aren't successful, you might need to turn off Windows Firewall. To do so$,$ right$-$click Start and click Control Panel, and under Network and Internet, click "View network status and tasks." In the Network and Sharing Center, click Windows Firewall at the lower left, and then click Turn Windows Firewall on or off. Under Public network location settings, click Turn off Windows Firewall, and then click OK$.$ Close the Windows Firewall window, and repeat Step $3.$

On Computer$1,$ start Wireshark. $($If Wireshark isn't on your desktop, right$-$click Start, click Run, type Wireshark in the text box, and press Enter.$)$

By default, Wireshark captures all the packets your NIC sees. You want to limit the packets to only those created by the ping command, so click Capture Options on the left $($see Figure $2-6).$ In the Capture Filter text box, type icmp. You must use lowercase letters. $($Internet Control Message Protocol $[$ICMP$]$ packets are created by the ping command.$)$ Click Start.

Figure $2-6$ The Wireshark main window

Source: Wireshark Foundation,

www$.$wireshark.org

$6.$ First, you ping from Computer $2$ to Computer$1.$ On Computer$2,$ type ping IPaddress at the command prompt and press Enter $($replacing IPaddress with the IP address of Computer$1).$

Network Switches

$61$

$7.$ On Computer$1,$ click the Stop the running live capture toolbar icon to stop the capture. You should see a window similar to Figure $2-7.$

Figure $2-7$ Ping packets captured on Computer$1$

Source: Wireshark Foundation,

www$.$wireshark.org

$8.$ On Computer$1,$ click Capture, Start from the Wireshark menu. Click Continue without Saving.

$9.$ Next, you ping from Computer$2$ to Computer$3.$ On Computer$2,$ type ping IPaddress at the command prompt and press Enter $($replacing IPaddress with the IP address of Computer$3).$ Wireshark running on Computer$1$ should have captured the ping packets. Stop the capture and exit Wireshark. Why are the packets sent between Computer $2$ and Computer$3$ captured by Computer$1?$

$10.$ Close the command prompt window, and shut down all computers.