Computer Networks Tutorial
COL 334/ COL 672
What is it
● An Open Source Software
tool
● A network packet analyzer.
● GUI as well TShark utility
from command line
● Mainly used to troubleshoot
or debug network problems.
Purpose
● Troubleshoot Network problems
● Examine security problems
● Verify network applications
● Debugging protocol
implementations
● Learning network protocol internals
Features
● Available for Unix (flavors) and Windows.
● Capture live packet data from a network interface.
● Save captured packet data.
● Export some or all packets in a number of capture file formats.
● Filter packets on many criteria.
● Search for packets on many criteria.
● Create various statistics.
● Open files containing packet data captured with
tcpdump/WinDump
● Import packets from text files containing hex dumps of packet
data.
● Display packets with very detailed protocol information.
Install and Use Wireshark on Ubuntu Linux
● sudo apt install wireshark
● Check for the latest version of wireshark using the following command
○ apt show wireshark
○ current stable release of Wireshark is 3.6
○ Update using:
■ sudo add-apt-repository ppa:wireshark-dev/stable
■ sudo apt update
■ sudo apt install wireshark
● To run wireshark after installation:
○ sudo wireshark
To run Wireshark without sudo use the following command:
○ sudo dpkg-reconfigure wireshark-common – Press YES
Installing from source code (ubuntu) – Download Wireshark
Unpack the source from its compressed tar file. If you are using Linux or your version of UNIX uses GNU tar you can use the
following command:
tar xJf wireshark-3.4.7.tar.xz
In other cases you will have to use the following commands:
xz -d wireshark-3.4.7.tar.xz
1. tar xf wireshark-3.4.7.tar
2. Create a directory to build Wireshark in and change to it.
a. mkdir build
b. cd build
3. Configure your source so it will build correctly for your version of UNIX. You can do this with the following command:
cmake ../wireshark-3.4.7
Build the sources.
make
Once you have built Wireshark with make above, you should be able to run it by entering run/wireshark.
4. Install the software in its final destination.
5. make install
Once you have installed Wireshark with make install above, you should be able to run it by entering wireshark.
Install and Use Wireshark on Windows and Mac
Download & Installation
● Visit https://www.wireshark.org/download.html
● Identify the required OS
● Download and save the latest stable release
Windows
Install the downloaded executable <stable version>.exe
Statistics Analysis
● Capture File Properties
● Conversations:
○ A network conversation is the traffic between two specific endpoints.
● Packet Lengths:
○ Shows the distribution of packet lengths and related information.
● Endpoints
○ Details on specific endpoints
● HTTP Statistics
○ Requests, Responses
● I/O Graphs
● Flow Graphs
Statistics Analysis
What is it not
● An intrusion detection system.
● Manipulate things on the network, it will only “measure” things from it.
● Send packets on the network or do other active things
Iperf /iperf3
Install iperf3 on Linux Ubuntu
sudo apt install iperf3
Windows/Others:
Download from https://iperf.fr/iperf-download.php
#Know about iperf3 usage
iperf3 -help
#In Server Mode
iperf3 -s
#In Client Mode
iperf3 -c <connect to host ip address>
Task 1
Capture Internet traffic using Wireshark for 5 minutes, check for TCP, UDP,
ICMP packets in the trace by using appropriate filters. Check the conversations,
flow graphs, I/O graphs
● UDP : Take DNS Packets (Run nslookup iitd.ac.in during the capture from
terminal)
TCP: Take HTTP/SSL Packets from your most favourite university website in India
ICMP: Ping iitd.ac.in from terminal
Task 2
Run iperf3 communication program locally using server-client modes. Capture its
Wireshark trace and check for IP Addresses, TCP/UDP conversation being used in
the communication, Ports, Ethernet interface.
Ubuntu:
server: iperf3 -s
client: iperf3 -c <connect to host ip address>
ip address – check using ifconfig
TCP
IPERF3
SERVER
IPERF3
CLIENT
Statistics
|
Conversations
Statistics
|
I/O Graph
UDP
IPERF3
SERVER
IPERF3
CLIENT
References
● https://www.wireshark.org/
● https://www.wireshark.org/docs/wsug_html_chunked/AppProtocols.
html
● https://www.wireshark.org/docs/wsug_html_chunked/
● https://packetlife.net/media/library/13/Wireshark_Display_Filters.pdf
● https://jvns.ca/blog/2018/06/19/what-i-use-wireshark-for/
● https://iperf.fr/
● https://itsfoss.com/install-wireshark-ubuntu/
