Wireshark :

Introduction

Wireshark is a free and open-source packet analyzer. It captures the packets that pass through a network interface and displays the contents of every protocol layer (Ethernet, IP, TCP/UDP and application protocols such as HTTP, DNS, ARP and ICMP). It is used for network troubleshooting, protocol analysis and learning how the protocols work.

Note: capture packets only on networks that you own or are authorised to monitor.

i. Packet Capture Using Wireshark

A packet capture is a recording of the frames that arrive at (or leave) a network interface. Wireshark uses the libpcap / Npcap library to put the interface in capture mode.

Installation:

# Ubuntu / Debian
sudo apt update
sudo apt install wireshark

# allow a normal user to capture (log out and log in again afterwards)
sudo usermod -aG wireshark $USER

# Windows / macOS: download the installer from https://www.wireshark.org/download.html

ii. Starting Wireshark

Steps:

1. Start Wireshark (from the applications menu, or type wireshark in a terminal).
2. The Capture home screen lists all available interfaces (for example Wi-Fi, Ethernet, loopback). The small graph next to an interface shows its live traffic.
3. Select the interface that carries your traffic (double-click it, or select it and click the blue shark fin button) to start the capture.
4. Generate some traffic: open a web page, run ping 8.8.8.8 or run nslookup studyglance.in.
5. Click the red Stop button to stop the capture.
6. Save the capture with File → Save As (extension .pcapng).

To capture from a terminal (no GUI), the command-line tool tshark can be used:

# capture 20 packets on interface eth0
sudo tshark -i eth0 -c 20

# save the capture to a file
sudo tshark -i eth0 -c 100 -w capture.pcapng

iii. Viewing Captured Traffic

The main window is divided into three panes:

Useful actions:

• Colouring rules – packets are coloured by protocol (for example TCP, UDP, ICMP, errors).
• Follow a stream – right-click a TCP packet and choose Follow → TCP Stream to see the whole conversation as text.
• Time display format – View → Time Display Format (for example seconds since the beginning of capture).
• Find a packet – Edit → Find Packet (Ctrl+F) searches by string, display filter or hex value.

iv. Analysis and Statistics & Filters

Display filters

A display filter is typed in the filter bar (just below the toolbar) and hides all packets that do not match. It can be applied to a capture that has already been recorded.

The filter bar turns green when the filter is valid and red when it is not. Operators: ==, !=, >, <, && (and), || (or) and ! (not).

Capture filters

A capture filter (BPF syntax) is set before the capture starts (Capture → Options) and decides which packets are recorded at all.

host 192.168.1.10
port 80
tcp
udp port 53
net 192.168.1.0/24
tcp and port 443

Statistics

The Statistics menu summarises a capture:

• Capture File Properties – number of packets, duration, average packets/second and bytes/second.
• Protocol Hierarchy – percentage of packets and bytes for each protocol.
• Conversations – traffic between each pair of addresses (Ethernet, IPv4, TCP, UDP).
• Endpoints – total traffic sent and received by each address.
• I/O Graphs – packets or bytes per second plotted against time.
• Flow Graph – a time-sequence diagram of a conversation (for example the TCP three-way handshake).
• TCP Stream Graphs – throughput, round-trip time and time-sequence graphs of a TCP connection.

Observation

Record the following in the lab record: the interface used, the display filters applied with a screenshot of the result, the Protocol Hierarchy of the capture, and the packets of one TCP three-way handshake (SYN, SYN-ACK, ACK) with their sequence numbers.