CSIS 330
LAB: 3.7.10 – USING WIRESHARK TO CAPTURE NETWORK TRAFFIC
GEYER
Answer following questions as part of your homework delivery. Go to the end of the document
for submission details:
1. What is the duration of your capture in seconds? What about the start and end time of the
capture expressed in hh:mm:ss? (Take a Screenshot of this screen)
Start time: 17:16:32.243682
End time: 17:16:52.677877
Duraction: 20.434195
_____________________________________________________________________________
2. How many protocols do you see in the protocol window? Name some of these for me? You
can get these info from the “protocol” field. You can sort on this or any other field in the window.
You can also add or delete fields from the list.
I see 10 different protocols out of 8720 packets that were captured. TCP has the most packets out
of the rest of the protocols listed. QUIC has the second most packets out of the bunch.
Page 1 of 4
CSIS 330
_____________________________________________________________________________
3. How many IPv4 or IPv6 conversations do you have in your capture? You can get these if you
investigate
Statistics -> Conversations.
I found 7 total IPv6 convetstions out of the 8720 total packets in my session.
_____________________________________________________________________________
4. What is the IP address of the DNS server you are connecting to?
To minimize the search time you should search for a specific string, in this case “google” since
we ended up typing www.google.com in the web browser and it is what the system needs to
resolve with DNS to get to the appropriate IP address of the Google server servicing your search
request. To find a string within a packet, click on Edit > Find Packet. Under "Find By:" select
"string" and enter your search string in the text entry box.
_____________________________________________________________________________
5. What is the IP address of the Google server?
Once you locate DNS query within all captured packets, you will be able to easily find this
address is well.
DNS was running through IPv6, IP address as follows:
2601:151:8200:8a60:2030:6727:7484:c5f9
_____________________________________________________________________________
6. Type udp.port in Apply a display filter … <Ctrl-/>? field and click Enter.
List protocols in ”Protocol” field that you see now.
Page 2 of 4
CSIS 330
UDP, SSDP, QUIC, MDNS, and DNS protocols were all present in this search.
_____________________________________________________________________________
Now type udp.port in Apply a display filter … <Ctrl-/>? field and click Enter.
List protocols in ”Protocol” field that you see now.
I see the same protocols present in this search.
_____________________________________________________________________________
7. What is Checksum in UDP header used for and can it be used for reliable data delivery?
It is used to increase the performance of the transaction and for UDP-lite it is used for error
checking.
_____________________________________________________________________________
8. What is Checksum field in UDP header used for and can it be used for reliable data delivery?
It is used to increase the performance of the transaction and for UDP-lite it is used for error
checking.
_____________________________________________________________________________
9. What is TOS field in IP header used for and can it be used for reliable data delivery?
TOS is used to show throughput type, delay time, and reliability.
_____________________________________________________________________________
10. What is Sequence Number field in TCP header used for?
The sequence number is used for acknowledgement of data acknowledgement.
_____________________________________________________________________________
Page 3 of 4
CSIS 330
11. What is timestamp field in UDP header used for?
To get time stamps of when the packet was sent and when it arrived, this can be used to measure
ping.
_____________________________________________________________________________
12. Elaborate how router uses TCP acknowledgment for reliable packet delivery?
TCP offers end-to-end packet delivery, it does this by having an acknowledgment number for
both the sender and the reciver.
_____________________________________________________________________________
Please return your completed assignments using Canvas.
The following documents are required as part of your submission.
This answer Template completed
Wireshark Capture Assignment1 wireshark.pcap
Both files must be uploaded to receive full credit for this assignment.
Page 4 of 4
Powered by TCPDF (www.tcpdf.org)
