Lab Tasks
In this lab, students will learn
• To utilize Wireshark and TCPdump tool for capturing packets and analyze its
contents
Overview
This lab focuses on the installation of Wireshark and tcpdump tool for capturing and
analyzing how each layer sends and receive packet information.
• Wireshark is a free and open-source packet analyzer. It is used for network
troubleshooting, analysis software, and communications protocol development,
and education.
• Network administrators use tcpdump to analyze traffic in Linux systems. Learn
how to install and use tcpdump, as well as examine the results of captured traffic.
Protocol analyzers, also known as packet sniffers, capture network data for display
or use by administrators. The captures include transport layer content, application
layer information and header information, such as physical and logical addresses.
Network administrators usually find this information more useful than the actual
data payload.
Lab Tasks
Task 1: Installing Wireshark and tcpdump
Step 1: for Wireshark tool
https://www.wireshark.org/download.html
Step 2: to install tcpdump
yum install tcpdump
apt-get install tcpdump
For more information
https://www.hugeserver.com/kb/install-use-tcpdump-capture-packets/
Task 2: http and https application data
Task 2a: to show https is more secure than http on
www.example.com
Step 1: find the IP address of www.exmple.com
Ping www.example.com
Give your observation with a screenshot.
Step 2: capture the data packets by running the Wireshark in the background and
htttp://www.example.com in the browser.
Give your observation with a screenshot!
Step 3: capture the data packets by running the Wireshark in the background and
https://www.example.com in the browser.
Give your observation with a screenshot!
Task 2b: capture and analyze TCP handshake packets.
Give your observation with a screenshot!
Task 3: Filtering packets based on source IP address
In the Wireshark tool specify the source address ip.src==93.184.215.14
Give your observation with a screenshot!
