Tracing network though network tools using Wireshark

Introduction

The home interface of wireshark looks like shown below. Using wireshark we can easily trace what is happening in the network. Wireshark basically snoops your network interface to see what data bits is going through and interprets into meaningful protocols.

Here are some examples people use Wireshark for:

• network administrators use it to troubleshoot network problems
• network security engineers use it to examine security problems
• developers use it to debug protocol implementations
• people use it to learn network protocol internals

Beside these examples, Wireshark can be helpful in many other situations too.

The main window is divided into list pane(above), details pane(below) and bytes pane(right) as shown in figure

• The packet list pane displays a summary of each packet captured. By clicking on packets in this pane you control what is displayed in the other two panes.
• The packet details pane displays the packet selected in the packet list pane in more detail.
• The packet bytes pane displays the data from the packet selected in the packet list pane, and highlights the field selected in the packet details pane.

This completes introduction to wireshark. Now it is time to see some protocols in action.

1.Ping:

Ping like any other network tools can be easily traced using wireshark. Below is my network interface configuration. It is a wireless adapter with dynamically allocated IP 192.168.33.120

        1) Start with ping 8.8.8.8 (gooogle dns)

        2) Now click the green start button after choosing your current network interface.

        3) Wireshark starts tracing the packets once you start it. It is recommended to start wireshark before using any network tools so that you don't miss needed packets. Type icmp in the filter box to see only ping packets.

2. Trace Route:

Traceroute helps to find the path taken by the packet to reach the destination. The main field to note here is the TTL which determines how many hops are needed to reach the destination.

        1) Now click the green start button after choosing your current network interface.

        2) Type traceroute 8.8.8.8 in linux and trroute 8.8.8.8 in windows

        3) Above is shown path to 8.8.8.8 which takes around 12 hops to reach destination. The wireshark trace is shown below. Here you can see TTL to be 5. Three packets for each TTL is recorded and shown here.

3. WGET:

Wget is a tool used to fetch a web page using CLI instead of a web browser. Here am going to shown trace while fetching www.google.com

        1) Click the green start button after choosing your current network interface.

        2) Type wget www.google.com in terminal. Make sure you have already installed the wget package. An HTTP request is sent and a response index.html.1 is received back.

        3) Shown below a typical TCP three way handshake Request-Response-Ack for connection establishment.

        4) DHCP: DHCP server allocates IP address dynamically whenever new host joins it's network. Trace of DHCP server 172.16.28.1 allocating IP address 172.16.29.195 is shown where DORA procedure takes place.

        5) ARP: Here using the same trace we can see network configuration protocol like ARP in action. ARP is used to find the mac address when IP address of the destination is known. Just type arp in filter box to see only arp packets.

        6) DNS: Domain name service is used to find the IP address given a URL eg: www.google.com > 74.125.200.104. Trace shown below with Queries and answers of www.google.com. Type DNS to see only dns packets