Install Wireshark - Lab 4 Required Hardware: Use the Virtual Machine you created in last weeks exercise. You can do this lab exercise on any computer that is connected to the Internet and has Ethereal or WireShark software installed. Alternately, you can do this lab from the comfort of your own home or laptop by downloading and installing WireShark from www.wireshark.org (or Ethereal from www.ethereal.com ) and installing it on your local PC. In this lab you will: 1. Execute Wireshark and practice capturing data packets 2. Analyze the results from capturing packets for a file download from a web server. Part 1: Check computer addresses and start up Wireshark Capture 1. Determine the Physical MAC address and the IP address for the Ethernet interface of the computer you are using. 2. Start up Wireshark, click Capture!Interfaces and click the Capture button corresponding to your active Ethernet interface. Wireshark will begin running in Capture Mode and will open up a Wireshark Capture window showing you how many packets have been captured in real time. Part 2: Download Web Page 1. With Wireshark still running in Capture Mode, start up your favorite browser (Internet Explorer, Mozilla, Firefox or whatever) 2. Enter the following address: http://facweb.cs.depaul.edu/cwhite 3. A web page should appear in your browser from the authors home page 4. Close your browser window 5. Go back to the Wireshark Capture window and click the Stop button to stop the packet capture. 2 | P a g e Part 3: Verify that the Web Page Download has Been Captured 1. Back in the Wireshark window, you should now see lots of packets in the top summary pane. You can filter out all packets except HTTP packets by typing the word http into the Filter box (click View !Filter Toolbar if you dont see a Filter box at the top). This will make things much easier to read. 2. You should see a packet containing something like GET /facweb.cs.depaul.edu/ cwhite sent by your PC to request the web page download. 3. If the next packet listed (containing the reply from the web server to your PC) contains HTTP/1.1 200 OK and the next 3 are Continuation packets, then you have successfully captured the packets containing the lab html web page. Skip the following step. 4. On the other hand, if the reply from the web server contains HTTP/1.1 304 Not Modified, then this means Wireshark did not capture the packets from the web site because the web page was already stored (cached) in your browser. In this case you must clear your browser cache and then go back and re-do the capture as follows: a. First, you must clear the web cache in your browser. i. For Internet Explorer, click Tools ! Internet Options, then, under the General tab, click the Delete Files button within the Temporary Internet Files box area. ii. For Firefox, click Tools ! Options, then Privacy, Cache and click Clear. iii. For other browsers, youre on your own. b. Now in your Wireshark window, again select Capture!Interfaces and click the Capture button corresponding to the Ethernet interface. When prompted whether to save the previous capture, click Continue without saving. c. Go back to Part 2, step 1 above to download the web page again while Wireshark is capturing packets.