lab 1: packet sniﬃng and wireshark - computer science · lab 1: packet sniﬃng and wireshark ......

Lab1:PacketSniffingandWireshark

FengweiZhang

WayneStateUniversity Course:CyberSecurityPrac?ce 1

PacketSniffer•  Packetsnifferisabasictoolforobservingnetworkpacketexchangesinacomputer

•  Capturing(“sniffs”)packetsbeingsent/receivedfrom/byyourcomputer

•  Apacketsnifferitselfispassive

•  Displayingthecontentsofthevariousprotocolfieldsinthesecapturedpackets,butneversendingpacketsitself


PacketSnifferStructure


PacketSniffer(cont’d)•  Applica?ons(webbrowsers,FTPclients,emailclients)

•  Networkprotocols(Internetprotocol)

•  Packetcapture–  Thepacketcapturelibraryreceivesacopyofeverylink-layerframe

thatissentfromorreceivedbyyourcomputer

•  PacketAnalyzer–  Displayingthecontentsofallfieldswithinaprotocolmessage–  Understandingthestructureofallmessagesexchangedbyprotocols–  IP,TCP,HTTPheaders

•  Wireshark,TCPDump


TCP/IPNetworkStack•  TCP/IPisthemostcommonlyusednetworkmodelfor

Internetservices.

•  Becauseitsmostimportantprotocols,theTransmissionControlProtocol(TCP)andtheInternetProtocol(IP)werethefirstnetworkingprotocolsdefinedinthisstandard,itisnamedasTCP/IP.

•  Itcontainsmul?plelayersincluding:–  Applica?onlayer–  Transportlayer–  Networklayer–  Datalinklayer


AnExampleLayeredApproach


NetworkLayers


Applica?onLayer

•  Theapplica?onlayerincludestheprotocolsusedbymostapplica?onsforprovidinguserservices

•  Examplesofapplica?onlayerprotocolsareHypertextTransferProtocol(HTTP),SecureShell(SSH),FileTransferProtocol(FTP),andSimpleMailTransferProtocol(SMTP)


TransportLayer•  Thetransportlayerestablishesprocess-to-process

connec?vity,anditprovidesend-to-endservicesthatareindependentofunderlyinguserdata.

•  Toimplementtheprocess-to-processcommunica?on,theprotocolintroducesaconceptofport.TheexamplesoftransportlayerprotocolsareTransportControlProtocol(TCP)andUserDatagramProtocol(UDP).

•  TheTCPprovidesflowcontrol,connec?onestablishment,andreliabletransmissionofdata,whiletheUDPisaconnec?onlesstransmissionmodel.


InternetLayer•  TheInternetlayerisresponsibleforsendingpacketstoacrossnetworks.

•  Ithastwofunc?ons:1)Hostiden?fica?onbyusingIPaddressingsystem(IPv4andIPv6);and2)packetsrou?ngfromsourcetodes?na?on.

•  TheexamplesofInternetlayerprotocolsareInternetProtocol(IP),InternetControlMessageProtocol(ICMP),andAddressResolu?onProtocol(ARP).


LinkLayer

•  Thelinklayerdefinesthenetworkingmethodswithinthescopeofthelocalnetworklink.

•  Itisusedtomovethepacketsbetweentwohostsonthesamelink.AncommonexampleoflinklayerprotocolsisEthernet.


DataEncapsula?oninNetworkStack


Lab0

•  SigntheCSC4992CyberSecurityPrac?ceClassStudentAgreement

•  MakesureyoucanloginasCSC4992studentonZeroClient– UsingyourWSUaccessIDandpassword– ProvidingVMimagesforlabexperiments


Lab0(cont’d)•  Subscribecoursemailing-list–  [email protected]–  ListHomepage(webinterfaceforsubscriberstojoin/leavelist,postmessages,viewarchives):hip://lists.wayne.edu

•  Sendanemailtothelisttointroduceyourselfbynextclass

•  Sendazippedtest.txtfileonBackboardbythisweek


lab 1: packet sniﬃng and wireshark - computer science · lab 1: packet sniﬃng and wireshark ......

Documents