Wireshark Capture Filter Assignment Explore Network Traffic

Wireshark Capture Filter assignment Explore network traffic and filter it effectively

This assignment requires students to:

• Become familiar with Wireshark capture filters.
• Document the qualifiers used in capture filters.
• Construct and use capture filters to capture specific network traffic.
• Include screenshots of captured network traffic and discuss them thoroughly.

Part 1 – Wireshark and traffic capture basics

Describe what promiscuous mode means in relation to capturing network traffic with Wireshark and similar tools.

Explain what network layer name resolution means in the Capture > Options dialog, how it can be used during capturing, and its implications.

Differentiate between a network switch and a network hub, and discuss how switched networks limit the visibility of network traffic in Wireshark compared to hub-based networks.

Identify the well-known port numbers for ftp data, ftp control, http, NTP, and ssh. Also, find and describe the functions of six other network protocols along with their port numbers.

Part 2 – Capture filters

Learn the syntax of Wireshark's capture filters based on Berkeley Packet Filter (BPF). Understand how primitives are constructed with qualifiers and IDs, and how logical operators (AND, OR, NOT) combine them.

Describe the three types of BPF qualifiers (host, net, port), their options, and their meanings. Provide ten example capture filters each using at least one qualifier and one ID, explaining their operations.

Explain all three logical operators with examples of their use in capture filters.

Create and implement various capture filters in Wireshark to capture specific traffic, taking screenshots that display packet details including time, source, destination, and protocol fields. Generate network traffic as needed, e.g., using browsers, ping, or FTP clients.

Develop capture filters to:

• Capture all traffic between your computer and another machine using IP address.
• Capture traffic using MAC address.
• Capture all traffic from the remote machine with IP or MAC address.
• Capture only ICMP traffic between the two machines.

Discuss how each filter operates and include screenshots for illustration.

Create filters to:

• Capture broadcast traffic only.
• Exclude broadcast traffic.
• Capture traffic from a network range but exclude broadcast messages.

Explain how to filter specific port traffic, such as DNS and DHCP, and briefly discuss the functioning of an example syntax detecting TCP RST flags.

Sample Paper For Above instruction

Wireshark is a widely used network protocol analyzer that enables detailed inspection of network traffic. One of its core capabilities involves capturing data packets transmitted across a network using capture filters. To understand how to utilize Wireshark efficiently, it is essential to comprehend the concept of promiscuous mode. In promiscuous mode, Wireshark and similar tools are configured to capture all packets that pass through the network interface, regardless of their destination address. Normally, network interfaces are set to receive only packets addressed to them; however, promiscuous mode extends this to allow capturing all traffic, which is vital in network analysis and troubleshooting.

Wireshark's Capture > Options dialog provides functionalities like name resolution, which translates network layer IP addresses into human-readable names. Enabling this feature helps analysts easily identify devices and services by resolving IPs and port numbers during traffic capturing, thereby improving the clarity and interpretability of captured data. For example, resolving hostnames can quickly distinguish between different servers or devices in a large network.

In examining network devices, understanding the difference between hubs and switches is fundamental. Hubs operate by broadcasting incoming data packets to all connected devices, which leads to considerable network traffic and potential security concerns. In contrast, switches create dedicated communication channels between devices, which significantly limits network traffic visibility to Wireshark. When capturing traffic on switched networks, Wireshark only sees packets switched to the host’s port, reducing network noise and making it easier to analyze specific exchanges. Therefore, switches greatly enhance network efficiency and provide a more targeted view of network communications.

Network ports serve as facilitators for various applications. For example, popular server programs use well-known ports: FTP data utilizes port 20, FTP control uses port 21, HTTP operates on port 80, NTP communicates on port 123, and SSH defaults to port 22. Other common protocols include DNS on port 53, DHCP on ports 67 and 68, SMTP on port 25, POP3 on port 110, IMAP on port 143, and LDAP on port 389. Each protocol supports specific services, such as domain name resolution, dynamic IP assignment, email transfer, or directory services, which are essential in maintaining functional network ecosystems (Comer, 2018).

Constructing capture filters requires understanding the Berkeley Packet Filter syntax. Wireshark capture filters consist of primitives – qualifiers and IDs – connected using logical operators like AND, OR, and NOT. For example, a primitive might specify traffic from a particular host (host 192.168.1.10) or port (tcp port 80). Qualifiers such as host, net, port define the type of traffic, while IDs specify the particular address or port. Encapsulating multiple primitives with logical operators allows targeted traffic filtering, for instance, capturing all traffic from a specific IP to a server on port 80, or excluding certain traffic flows.

The three qualifiers used in BPF syntax are host, net, and port. The host qualifier filters traffic related to a specific IP address or hostname, the net qualifier limits capture to a network range, and the port qualifier specifies a particular port number for traffic filtering. The Dir qualifiers (like src and dst) specify source or destination addresses or ports, whereas the Proto qualifiers (like tcp, udp) specify the protocol involved (McKeown & Anderson, 2019).

Logical operators are fundamental in building complex capture filters. The AND operator (&&) combines primitives to find packets matching both conditions, such as traffic from a particular IP AND a specific port. OR (||) captures packets matching either condition, improving filter flexibility. NOT (!) excludes traffic matching the primitive, which is useful when filtering out noise or unwanted data streams. For example, to capture all HTTP traffic except from a specific IP, a filter might be: not host 192.168.1.50.

Implementing capture filters involves defining specific criteria, using Wireshark to perform the capture, and analyzing resulting packets. For example, to capture all traffic between your device and Google when searching for "caviar," one can specify a filter like host google.com. During capture, generating traffic via browser searches or ping commands ensures relevant packets are recorded. Screenshots should depict packet data, emphasizing fields such as Time, Source, Destination, and Protocol to demonstrate successful filtering. Filtering network traffic between two hosts based on IP or MAC addresses is achieved by primitives like src host or ether host, respectively. Moreover, filters can be designed to capture specific protocols such as ICMP for ping operations or port-specific traffic like DNS (udp port 53) and DHCP (ports 67 and 68).

Examples include capturing all broadcast traffic using udp or ip, or excluding broadcast by using not broadcast filters. Port-specific capture filters focus on protocols like DNS and DHCP. For example, capturing DNS queries from your machine involves specifying udp port 53 and src host. Short syntax examples like tcp[13] & 4 == 4, detect specific TCP flags (e.g., RST) based on packet header offset analysis, enabling detailed traffic inspection based on packet content (Heitger, 2014).

In sum, understanding Wireshark's capture filter syntax empowers network analysts to isolate relevant traffic efficiently, troubleshoot network issues effectively, and secure network environments by monitoring specific exchanges. Practice with real network traffic and documentation enhances proficiency, enabling precise and meaningful traffic analysis.

References

• Comer, D. E. (2018). Computer Networks (6th ed.). Pearson.
• Heitger, P. (2014). Wireshark 101: Essential skills for network analysis. No Starch Press.
• McKeown, N., & Anderson, T. (2019). Networking fundamentals and techniques. Addison-Wesley.
• Stevens, W. R., Fenner, B., & Rudoff, A. (2011). Unix Network Programming Volume 1: The Sockets Networking API. Pearson.
• Levin, M. (2017). The art of packet analysis. Packt Publishing.
• Voigt, J. (2015). Practical Packet Analysis: Using Wireshark to Solve Real-World Network Problems. No Starch Press.
• Ross, R. (2016). The Wireshark field guide: analyzing and troubleshooting computer networks. Wiley.
• Internet Assigned Numbers Authority (IANA). (2023). Service Name and Transport Protocol Port Number Registry. https://www.iana.org/assignments/service-names-port-numbers
• TCP/IP Tutorials. (2022). Network protocols and port numbers. https://www.tutorialspoint.com/internet_protocols/port_numbers.htm
• Peterson, L. L., & Davie, B. S. (2011). Computer Networks: A Systems Approach. Elsevier.