18BCE2188 JAESON KARTER JOSEPH 29/03/2021

a. Start Wireshark and look at the upper pane. What "Protocol" and "info" are shown for the very first packet that it
reports? Do you think this was caused by your use of the web browser? Why or why not?’

PROTOCOL: TLSv1.2

INFO: Application Data

Yes, it was caused by the use of web browser as google chrome was up and running in background

b. List up to 5 different protocols that appear in the protocol column in the unfiltered packet-listing window of the
lab activities

TCP, UDP, HTTP, DNS, ARP

c. How long did it take from when the HTTP GET message was sent until the HTTP OK reply was received? (By default,
the value of the Time column in the packet- listing window is the amount of time, in seconds, since Wireshark tracing
began. To display the Time field in time-of-day format, select the Wireshark View pull down menu, then select Time
Display Format, then select Time-of-day.)

According to the screenshot, the time interval between the HTTP GET message and HTTP OK message is16.882119s -
16.881203s = 0.000916s
 18BCE2188 JAESON KARTER JOSEPH 29/03/2021
d. In Wire shark If a packet is highlighted by black, what does it mean for the packet?

black identifies packets with errors—for example, they could have been delivered out of order.

e. In Wire shark What is the filter command for listing all outgoing http traffic?

http

f. In Wire shark Why does DNS use Follow UDP Stream while HTTP use Follow TCP Stream?

Here is why DNS uses UDP.

 UDP is much faster when compared to TCP. TCP is slow as it uses 3-way handshake.  
 DNS requests are generally very small and they fit well within UDP segments.
 UDP is not reliable, but reliability can be added to the application layer. An application can
use UDP can be made reliable by using the timeout and resend at the application layer.

Why does HTTP use TCP as the transport layer

protocol?
 to ensure the fastest possible download speed
 because HTTP is a best-effort protocol
 because transmission errors can be tolerated easily
 because HTTP requires reliable delivery
Explanation:
When a host requests a web page, transmission reliability and completeness must be guaranteed.

Therefore, HTTP uses TCP as its transport layer protocol.

g. How long did it take from when the HTTP GET message was sent until the HTTP Acknowledgement / OK reply was
received?

According to the screenshot, the time interval between the HTTP GET message and HTTP OK message is16.882119s -
16.881203s = 0.000916s
 18BCE2188 JAESON KARTER JOSEPH 29/03/2021
h. Which filter is used in Wireshark for capturing a specific type of traffic?

To filter traffic from any specific IP address type: ip.addr == 'xxx.xx.xx.xx' in the Apply a display filter field.

To filter traffic for specific protocol say TCP, UDP, SMTP, ARP, DNS Requests etc just type the protocol name in the
Apply a display filter field.

Wireshark has two filtering languages: capture filters and display filters. Capture filters are used for
filtering when capturing packets Display filters are used for filtering which packets are displayed
and are discussed below.

Display filters allow you to concentrate on the packets you are interested in while hiding the
currently uninteresting ones. They allow you to only display packets based on:

 Protocol
 The presence of a field
 The values of fields
 A comparison between fields

To only display packets containing a particular protocol, type the protocol name in the display filter
toolbar of the Wireshark window and press enter to apply the filter. 

i. Which filter is used in wireshark for capturing all type of traffic content.?

In Wireshark, there are capture filters and display filters. Capture filters only keep

copies of packets that match the filter. Display filters are used when you’ve captured
everything, but need to cut through the noise to analyze specific packets or flows

2. Do the following steps for capturing the information and answer the following questions.

Step 1: Start browser and Wireshark on correct interface

Step 2: Start capturing the data packets for various urls.

 18BCE2188 JAESON KARTER JOSEPH 29/03/2021

Step 3: Stop the capture

Step 4: Save it as .pcap file

 18BCE2188 JAESON KARTER JOSEPH 29/03/2021

Write a Python program to extract the following details from wireshark pcap file

a. No of ARP Request.

b. No of TCP SYN

c. No of UDP request

d. No of IPV4 request
 18BCE2188 JAESON KARTER JOSEPH 29/03/2021

e. No of IPV6 request

f. To print the source MAC_Address, Destination MAC_Address, Src_Port, Dest_Port.

 18BCE2188 JAESON KARTER JOSEPH 29/03/2021

Or

import dpkt
import datetime
import socket
from dpkt.compat import compat_ord

def mac_addr(address):
"""Convert a MAC address to a readable/printable string

Args:
 18BCE2188 JAESON KARTER JOSEPH 29/03/2021
address (str): a MAC address in hex form (e.g. '\x01\x02\x03\x04\x05\x06')
Returns:
str: Printable/readable MAC address
"""
return ':'.join('%02x' % compat_ord(b) for b in address)

def inet_to_str(inet):
"""Convert inet object to a string

Args:
inet (inet struct): inet network address
Returns:
str: Printable/readable IP address
"""
# First try ipv4 and then ipv6
try:
return socket.inet_ntop(socket.AF_INET, inet)
except ValueError:
return socket.inet_ntop(socket.AF_INET6, inet)

def print_packets(pcap):
"""Print out information about each packet in a pcap

Args:
pcap: dpkt pcap reader object (dpkt.pcap.Reader)
"""
# For each packet in the pcap process the contents
for timestamp, buf in pcap:

# Print out the timestamp in UTC

print('Timestamp: ', str(datetime.datetime.utcfromtimestamp(timestamp)))

# Unpack the Ethernet frame (mac src/dst, ethertype)

eth = dpkt.ethernet.Ethernet(buf)
print('Ethernet Frame: ', mac_addr(eth.src), mac_addr(eth.dst), eth.type)

# Make sure the Ethernet data contains an IP packet

if not isinstance(eth.data, dpkt.ip.IP):
print('Non IP Packet type not supported %s\n' % eth.data.__class__.__name__)
continue

# Now unpack the data within the Ethernet frame (the IP packet)
# Pulling out src, dst, length, fragment info, TTL, and Protocol
ip = eth.data

# Pull out fragment information (flags and offset all packed into off field, so use bitmasks)

do_not_fragment = bool(ip.off & dpkt.ip.IP_DF)

more_fragments = bool(ip.off & dpkt.ip.IP_MF)
fragment_offset = ip.off & dpkt.ip.IP_OFFMASK
 18BCE2188 JAESON KARTER JOSEPH 29/03/2021
# Print out the info

print('IP: %s -> %s (len=%d ttl=%d DF=%d MF=%d offset=%d)\n' % \

(inet_to_str(ip.src), inet_to_str(ip.dst), ip.len, ip.ttl, do_not_fragment, more_fragments, fragment_offset))

def test():
"""Open up a test pcap file and print out the packets"""
with open('LAB3.pcap', 'rb') as f:
pcap = dpkt.pcap.Reader(f)
print_packets(pcap)

if __name__ == '__main__':
test()