Fortunately I have TCP-IP subject in this semester and so I decided to make the subject more interesting using Wireshark sniffing. It is the second best security assessment tool according to insecure.org.
It allows you to examine data from a live network delving down into just the level of packet detail you need. It also supports hundreds of protocols and media types.
Follow these steps and get started.!
- Download wireshark http://www.wireshark.org/ Direct install if you are using windows. For ubuntu users – sudo apt-get install wireshark
- To start capturing the network traffic click on Capture -> Interfaces. you will get a list of interfaces available. click on start to capture.
- Packets must have started pouring.. To stop the capture. Capture -> stop.
- Now you are ready to analyze the packets.
As you can see there are 4 different columns-
- No : indicates the order in which the packets are received.
- Time : Sec. since the last packet. click on view -> Time display format.
- source : source IP or MAC address.
- Destination : Destination IP or MAC address.
- Protocol : Protocol used by the packet.
- Info : summarized info of the packet content.
Now you can click on packet you wanna examine and the details are shown below.
Since its an IP packet… you can see the various TCP/IP layers -
- Frame : provides the physical layer details
- Ethernet II : provides MAC details
- Internet Protocol : provides source logical IP and destination logical IP.
- TCP/UDP : displays port details.
- Data : application data.
Expand the trees and view all the details about the TCP / IP communication.
..Stay tuned for more posts on wireshark sniffing….