Cnip Final
Cnip Final
SESSION: 2023-24
COMPUTER
NETWORK
AND
INTERNET PROTOCOL
LAB (AIML-256)
II Year, IV Sem
Introduction- Wireshark is a software tool used to monitor the network traffic through a
network interface. It is the most widely used network monitoring tool today. Wireshark
is loved equally by system administrators, network engineers, network enthusiasts,
network security professionals and black hat hackers.
The extent of its popularity is such, that experience with Wireshark is considered as
a valuable/essential trait in a computer networking-related professional.
Wireshark installation:
Step-1 : Download Wireshark from www.wireshark.org and select Windows x64 Installer.
Step-2: Select every option and click on next button till install window.
Introduction:- Wireshark is the default goto tool for analyzing captured network traffic for
most network engineers. But there are a few other free and open source alternatives that are
sometimesoverlooked, one of which is NetworkMiner.
Data formats
Standardization of protocols and data formats has been a problem but is now growing in
the industry and XML, JSON, and YAML are increasingly being adopted for data
exchange. The development of the Semantic Web and the Internet of Things is likely to
accelerate this presenttrend.
Applications:-
Examples:-
AIM: Running and using commands like ping, trace, route, nslookup, ftp, etc
The tracert command prints the path. If all routers on the path are functional, this command
prints the full path. If a router is down on the path, this command prints the path up to the
last operational router.
The following table lists some important options of the tracert command.
Ping :- The ping command is used to test connectivity between two hosts. It sends ICMP
echo request messages to the destination. The destination host replies with ICMP reply
messages. If the ping command gets a reply from the destination host, it displays the reply
along with round-trip times.
Arp :- To send IP packets, a computer needs two addresses. These addresses are the MAC
address and the IP address. A MAC address is the physical or hardware address of the NIC.
An IP address is the logical or software address of NIC. If a computer knows the IP address
of the destination computerbut it does not know the MAC address of the destination
computer, it uses the ARP protocol to knowthe MAC address of the destination computer.
The ARP protocol broadcasts a given IP address over a local network. The corresponding
host responds to the broadcast with its MAC address. To avoid repetition, ARP stores the
answer in a tableknown as ARP table. ARP maintains a separate ARP table for each NIC.
To view the ARP table, you can use the following command.
Netstat :-
This command displays active connections, ports on which the computer is listening,
Ethernet statistics, the IP routing table, and IP statistics.
The output of this command is organized in rows and columns. Each row represents a new
connection or an entry in the output. It contains four columns. These columns provide the
following informationabout the row.
Proto: - This column displays the name of the protocol (TCP or UDP).
Local Address: - This column displays the IP address of the local computer and the port
number being used. If the port is not yet established, the port number is shown as an asterisk
(*).
Foreign Address: - This column displays the IP address and port number of the remote
computer towhich the port is connected.
State: - This column displays the status of the connection.
A bandwidth analyzer is a type of software that detects, collects, monitors, and analyzes
network bandwidth data and metrics. It is used by network administrators to view the
overall network/Internet bandwidth that a particular network is receiving and sending. Here
are some key points about bandwidth analyzers:
Measurement: Its key function is to provide the amount/size of data that is downloaded or
uploaded and the overall bandwidth being used.
Advanced Features: Enterprise-level bandwidth analyzers can drill into the details of each
network packet, offering performance and security-related data. This includes peak usage
time, most-used protocols, active systems, source and destination IP addresses, and more.
Alerts: Bandwidth analyzers can also alert network administrators when a bandwidth use
threshold is reached, providing application/user/system-specific bandwidth use details.
Traffic Analysis: They provide detailed insights into the traffic patterns on your network.
Bandwidth Monitoring: Track the amount of bandwidth being used by various devices
and applications.
Site24x7 Network Bandwidth Monitoring: A SaaS service that monitors network traffic
using flow protocols. It’s great for tracking bandwidth usage and identifying potential
issues. You can start a 30-day free trial.
Paessler PRTG Network Monitor: PRTG offers a bundle of monitoring tools for
networks, servers, and applications. It includes traffic sampling sensors for effective traffic
management. Thesoftware installs on Windows Server.
Nagios: A monitoring package for networks, servers, and applications. It’s available in both
free and paid versions and runs on Linux or as a VM for Windows.
ntopng: An open-source network monitor that uses nProbe for traffic flow information.
Cacti: A complete network graphing solution harnessing the power of RRDTool’s data
storage and graphing
functionality.
Experiment 04
AIM: Implementation of packet capture and observations using packet sniffer
Packet Capture refers to the action of capturing Internet Protocol (IP) packets for review or
analysis. The term can also be used to describe the files that packet capture tools output,
which areoften saved in the .pcap format. Capturing packets is a common troubleshooting
technique for network administrators, and is also used to examine network traffic for
security threats.
Following a data breach or other incident, packet captures provide vital forensic clues that
aid investigations. From a threat actor’s perspective, packet captures might be used to steal
passwordsand other sensitive data. Unlike active reconnaissance techniques like port
scanning, capturing packets can be accomplished without leaving any trace behind for
investigators.
1. Download and Install Wireshark: Get Wireshark from the official website
and install it onyour computer.
2. Launch Wireshark: Open Wireshark after installation.
3. Select Network Interface: Choose the network interface (like Ethernet or Wi-
Fi) throughwhich you want to capture packets.
4. Start Capture: Click the "Start" button (usually a green shark fin icon)
to begin capturingpackets.
5. Optional Filters: Apply capture filters if needed to capture specific types of
traffic or filter bycriteria like IP addresses or protocols.
6. Stop and Save Capture: Click "Stop" (red square icon) when you've
captured enough data,then save the capture file (PCAP or PCAPNG format).
7. Analysis: Open the saved capture file in Wireshark for detailed analysis, using
filters, statistics,and other tools for deeper insights into network traffic and
protocols.
Packet sniffing
Wireshark is a packet sniffing program that administrators can use to isolate and
troubleshoot problems on the network. It can also be used to capture sensitive data like
usernames and passwords. It can also be used in wrong way (hacking) to ease drop. Packet
sniffing is defined as the process to capture the packets of data flowing across a computer
network. The Packet sniffer is a device or software used for the process of sniffing.
Overall, Wireshark's capabilities make it an essential tool for network troubleshooting,
performance optimization, security monitoring, and protocol analysis. However, it's
important to use packet sniffing tools like Wireshark responsibly and in compliance with
legal and ethical guidelines, especially when capturing sensitive or confidential information.
Protocol Theory:
Hypertext Transfer Protocol (HTTP) is an application layer protocol that is used for loading web
pages consisting of hypertext links. It is designed within the framework of Internet Protocol Suite.
This protocol aims to transfer information among network devices. It runs on top of other layers of
the network protocol stack. It is used for transferring data in the format of audio, video, hypertext,
and plain text. Hypertext Transfer Protocol has a client-server architecture. It allows the reliable
transfer of resources between the web application server and the user agent.
Client-Server Model: HTTP operates on a client-server model, where a client (such as a web
browser) sends requests to a server (such as a web server), and the server responds with the requested
resources.
Statelessness: HTTP is stateless, meaning each request from a client to the server is independent and
unrelated to any previous requests. This simplifies implementation but requires additional
mechanisms for maintaining state, such as cookies or session management.
Request Methods: HTTP defines several request methods or verbs that indicate the desired action to
be performed on a resource. Common methods include GET (retrieve a resource), POST (submit
data to be processed), PUT (store a resource), DELETE (remove a resource), and more.
Uniform Resource Identifier (URI): HTTP uses URIs to identify resources on the web. A URI
consists ofa scheme (such as "http" or "https"), a hostname, and a path to the resource.
Headers: HTTP headers provide additional information about the request or response. Request
headers can include information such as te type of content the client can accept, while response
headers can include details like the content type of the resource being returned.
Status Codes: HTTP uses status codes to indicate the result of a request. These codes are grouped
into different categories, such as 1xx for informational responses, 2xx for successful responses, 3xx
for redirection responses, 4xx for client error responses, and 5xx for server error responses.
Message Format: HTTP messages consist of a start line, headers, and an optional message body.
The startline includes the request method or status code, the URI or target resource, and the HTTP
version.
Connection Management: HTTP allows for various mechanisms for managing connections
betweenclients and servers, including keep-alive connections to reuse TCP connections for multiple
requests.
Caching: HTTP supports caching to improve performance and reduce network traffic. Both clients
andservers can use caching mechanisms to store and reuse previously requested resources.
Security: While HTTP itself is not secure, HTTPS (HTTP Secure) provides a secure version of HTTP by
encrypting data transmitted between the client and server using SSL/TLS protocols.
Advantages:
● It helps in fetching not only hypertext documents but also media like videos and images.
● Enables easy communication among devices and applications on the web.
● Reduces network congestion as there are very few TCP connections.
● It eliminates the need to ask the sender about applications that are required to read or view
file content.
Disadvantages:
● It is difficult to confirm if the web server sending the request is the same one that has
returned the response. This increases the probability that the client may be spoofed.
● There is difficulty of blocking Dos attacks under massive requests.
● Since it cannot prove the integrity of the message of communication, it is impossible to
confirm the request and received response is the same. This allows attackers to intercept and
tamper the content while the response is in transit.
Experiment 06
AIM: Tracing DNS with Wireshark
Theory:
DNS or Domain Name System abbreviated as DNS is a system used to resolve domain
names, IP addresses, different servers for e.g., FTP servers, game servers,active
directories, etc., and keep their records. Invented by Jon Postel and Paul Mockapetris in
1982, DNS has now become one of the most significant players inthe modern-day web
world.
DNS actually gives a mapping of the hostname of a network and its address. It
hasproved to ease human life manifold when one looks at its working and the service it
offers. It helps users by translating the domain names into IP addresses, allowingthem
to surf the web without memorizing such complex IP codes. Coming on to Wireshark,
which is an open-source packet analyzer and has been widely in use since its inception
in the web world, to analyze packets received or sent in a network. We can use
Wireshark to segment the DNS system and get a detailed look at it. The default port for
DNS traffic in Wireshark is 53, and the protocol is UDP (User Datagram Protocol).
After we start Wireshark, we can analyze DNS queries easily. We shall be following the
below steps:
After this, browse to any web address and then return to Wireshark. Browsing would get
packets captured and in Wireshark click the stop in the Capture menu tostop the capture.
If you haven’t got the packet list by now, you can access it using Edit → Find
Packets. This will give you the packet list.
Since we are going to analyze DNS we shall be studying only DNS packets and toget
DNS packets, only you can apply DNS in the filters above.
A basic DNS response has:
Name: Domain name of the destination or web address to be reached or reached byin
case of the received packet. This section further has its length, character by character
under [Name-Length], and the count of words separated by separators, i.e., dot(.) under
the name[Labels].
Type: which is ‘A’ for IPv4 (32 bits) and is ‘AAAA‘ for IPv6 (128 bits).
Class: which is ‘IN‘ by default, which means an internet IP address has been askedfor.
Captured packets are also stored in the local machine, We can also view ourreceived
packets in command prompt by typing the following instruction:
ipconfig /displaydns:
You can have a look at the below diagram for reference. Once you have visited a
particular resource it will be stored and the next time you want to locate a particular
resource, the host will try to find it in the local storage. So this is how wecan analyze
DNS queries in Wireshark and get a detailed knowledge of DNS packet functionalities.
Checking DNS queries in Wireshark is one of the major
tools for studying network behaviors, and Wireshark is by far the leading forum
for protocol analysis because of its beginner-friendly and detailed nature.
Theory:
So now we are a bit familiar with TCP, let’s look at how we can analyze TCP
using Wireshark, which is the most widely used protocol analyzer in the world.
Inorder to analyze TCP, you first need to launch Wireshark and follow the steps
given below:
● From the menu bar, select capture -> options -> interfaces.
● In the interfaces, choose a particular Ethernet adapter and note down its
IP,and click the start button of the selected adapter.
● Now we shall be capturing packets. Browse to a particular web address
to generate traffic to capture packets from the communication for e.g.
geeksforgeeks.org and return to Wireshark and stop the capture by
selectingstop from the capture menu. You can have a look at it in the image
below.
Now we have the captured packets and you will be having the captured packet list on the
screen. Since we are concerned here with only TCP packets as we are doing TCP
analysis, we shall be filtering out TCP packets from the packet pool. You can apply a
filter in any of the following ways:
● In the display filter bar on the screen, enter TCP and apply the filter.
● From analyzing the menu in the menu bar select display filters
or from capture select capture filters and then TCP only and ok.
Here you will have the list of TCP packets. The first three packets of this list arepart of
the three-way handshake mechanism of TCP to establish a connection.
Let’s get a basic knowledge of this mechanism which happens in the following 3steps:
You can observe these three steps in the first three packets of the TCP list whereeach
of the packet types i.e. ACK, SYN, SYN-ACK is listed on their respective side. Now
to examine a packet closely we shall select a packet and in the expertview in the
packet detail section just below the packet list we shall be having theTCP parameters
as you can see in the below diagram. Let’s look at each one of them and their
significance:
● Source port: This is the port of your host network used for communication.
● Destination port: This is the port of the destination server.
● TCP segment length: It represents the data length in the selected packet.
● Sequence number: It is a method used by Wireshark to give particular
indexing to each packet for tracking packets with ease. This indexing
startsfrom 0.
● Next sequence number: It is the sum of the sequence number and the
segment length of the current packet.
● Acknowledgment number: It contains the byte length of data received.
● Header length: It is the length of the TCP header and can vary from 20 to 60
A major section of this TCP packet analysis is the flag section of a packet whichgives further in-depth
information about the packet. The flag section has the following parameters which are enlisted with their
respective significance.
● Window size value: This is the buffer size of the current host.
● Checksum: It is used to verify that the received packet is OK or has an error.
● Checksum status: The packet checksum is not verified by default, but
onecan enable it as per requirements.
Finally, after we have done the analysis it’s time to understand how the TCP
connection is closed. It is commonly known as a TCP termination handshake. It
further happens in the following steps:
● The closing side or the local host sends the FIN or finalization packet.
● The server sends an ACK signaling it has received the FIN packet and
sendsa FIN packet for confirmation on the closing side.
EXPERIMENT 08
AIM: Create Ring, Star, Bus and Mesh topology using cisco packet tracer.
Theory:
Experiment Setup:
1. Launch Cisco Packet Tracer and create a new network simulation.
2. Use appropriate devices such as routers, switches, and PCs to represent the nodes in each topology.
3. Configure the connections between devices according to the chosen topology (ring, star, bus, or mesh).
4. Assign IP addresses to devices and configure basic settings such as subnet masks and default gateways.
5. Test the connectivity between devices within each network and observe how data transmission
behaves in different scenarios
1. Ring Topology:
● In a ring topology, devices are connected in a closed loop, where each device is connected
to exactly two other devices.
● Data travels in one direction around the ring until it reaches its destination.
● Advantages include simplicity and equal access to resources for all devices.
● Disadvantages include the potential for a single point of failure if one device fails or if there is a
break in the ring.
2. Star Topology:
3. Bus Topology:
● In a bus topology, all devices are connected to a single shared communication line, known as
a bus.
● Data is transmitted along the bus, and each device reads the data to determine if it is the intended
recipient.
● Advantages include simplicity, low cost, and easy expansion.
● Disadvantages include the potential for collisions and the entire network being affected if the
bus fails.
1. Mesh Topology:
● In a mesh topology, every device is connected to every other device in the network.
● Data can take multiple paths to reach its destination, providing redundancy and fault tolerance.
● Advantages include high reliability, scalability, and fault tolerance.
● Disadvantages include complexity, high cost, and the need for careful planning to avoid
network congestion.
Testing the connectivity between devices within each network by using PING command
Experiment no - 10
CODE
import heapq
Args:
graph: A dictionary representing the network graph where keys are nodes
and values are dictionaries of neighbors with associated edge
weights.
start: The starting node for the shortest path computation.
Returns:
A dictionary containing the shortest distances from the start node to all other
reachable nodes in the graph.
"""
distances = {node: float('inf') for node in graph}
distances[start] = 0
priority_queue = [(0, start)]
while priority_queue:
current_distance, current_node =
heapq.heappop(priority_queue) if current_distance >
distances[current_node]:
continue
for neighbor, weight in
graph[current_node].items(): distance =
current_distance + weight
if distance < distances[neighbor]:
distances[neighbor] = distance
heapq.heappush(priority_queue, (distance, neighbor))
return distances
OUTPUT
EXPERIMENT 09
AIM: Configure a network using distance network routing and link state vector routing protocol
Theory:
1. Distance Vector Routing Protocol (RIP):
● RIP is a simple routing protocol where routers exchange routing tables with their neighbors.
● Each router maintains a routing table containing the distance to each destination network and
the next hop router to reach it.
● RIP uses the Bellman-Ford algorithm to determine the best path to each destination network.
● RIP periodically broadcasts routing updates to its neighbors, which can lead to
convergence issues in large networks.
● RIP has a maximum hop count limit of 15, which limits its scalability in larger networks.
3. Configure IP Addresses:
• Access the CLI (Command Line Interface) of each router by double-clicking on it.
• Configure IP addresses on router interfaces using the interface and ip address
commands (e.g., interface GigabitEthernet0/0, ip address 192.168.1.1 255.255.255.0).
4. Enable RIP on Routers:
• Access the CLI of each router and enter global configuration mode using the configure
terminal command.
• Enable RIP routing protocol using the router rip command.
• Configure network statements to advertise connected networks (e.g., network 192.168.1.0).
5. Verify RIP Configuration:
• Use the show ip route command to verify the routing table entries on each router.
• Use the show ip protocols command to verify the RIP configuration and routing updates.
6. Test Connectivity:
• Ping between PCs or routers to test network connectivity.
• Verify that RIP is dynamically updating routing tables based on network changes.
2. Link-State Routing Protocol (OSPF):
● OSPF is a more sophisticated routing protocol based on link-state advertisements.
● Each router maintains a link-state database containing information about the network topology.
● OSPF routers exchange link-state advertisements (LSAs) to update their link-state databases
and calculate the shortest path to each destination network using Dijkstra's algorithm.
● OSPF supports hierarchical network design through the use of areas, which can improve
scalability and reduce routing overhead.
● OSPF converges faster and scales better than RIP in large networks.
3. Test Connectivity:
● Repeat step 6 from RIP Experiment to test network connectivity.
● Verify that OSPF is dynamically updating routing tables and forming neighbor adjacencies.