Wireshark Tutorial KUAS, Hao-Xiang Gu

Outline Introduction Resource User interface Filter Try it Yourself Reference

Introduction What’s Wireshark? Purpose: Other: It’s a free and open source packet analyzer. Purpose: It is used for network troubleshooting, analysis, software and communications protocol development, and education. Other: Originally named Ethereal, the project was renamed Wireshark in May 2006 due to trademark issues.

Resource Website Software Download Wireshark forum https://www.wireshark.org/ Software Download https://www.wireshark.org/download.html Wireshark forum https://ask.wireshark.org/ Wireshark User’s Guide https://www.wireshark.org/docs/wsug_html_chunked/index.html

User interface UI Menu Main toolbar Filter toolbar Packet List pane Packet Details pane Packet Bytes pane

Display Filter comparison operators English C-like Description and example eq = = Equal. ip.src==10.0.0.5 ne ! = Not equal. ip.src!=10.0.0.5 gt >  Greater than. frame.len > 10 lt <  Less than. frame.len < 128 ge > = Greater than or equal to. frame.len ge 0x100 le < = Less than or equal to. frame.len <= 0x20 contains Protocol, field or slice contains a value. sip.To contains "a1762" matches ~ Protocol or text field match Perl regualar expression. http.host matches "acme\.(org|com|net)" bitwise_and & Compare bit field value. tcp.flags & 0x02

Try it Yourself OSI model Layer name Protocol Layer 1 Physical Layer Data Link Layer Address Resolution Protocol, ARP Layer 3 Network Layer Internet Control Message Protocol, ICMP Layer 4 Transport Layer Transmission Control Protocol, TCP User Datagram Protocol, UDP Layer 5 Session Layer Layer 6 Presentation Layer Layer 7 Application Layer Domain Name System, DNS Bootstrap Protocol, BOOTP Dynamic Host Configuration Protocol, DHCP Hypertext Transfer Protocol, HTTP

Address Resolution Protocol ARP ARP Header Offsets Octet 1 2 3 Bit  0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Hardware type Protocol type 4 32 Hardware address length Protocol address length Opcode 8 64 Source hardware address 96 Source protocol address 128 Destination hardware address 160 Destination protocol address … 192 Data

Internet Control Message Protocol ICMP ICMP Header Offsets Octet 1 2 3 Bit  0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Type Code Checksum 4 32 Rest of Header

Transmission Control Protocol TCP TCP Header Offsets Octet 1 2 3 Bit  0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Source port Destination port 4 32 Sequence number 8 64 Acknowledgment number (if ACK set) 96 Data offset Reserved 0 0 0 N S C W R E C E U R G A C K P S H R S T S Y N F I N Window Size 128 Checksum Urgent pointer (if URG set) 20 ... 160 ... Options (if data offset > 5. Padded at the end with "0" bytes if necessary.) ... tcp

User Datagram Protocol UDP UDP Header Offsets Octet 1 2 3 Bit  0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Source port Destination port 4 32 Length Checksum udp

Domain Name System DNS [1] : Query/Response Flag DNS Format Offsets Octet 1 2 3 Bit  0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Identifier [1] Operation Code [2] [3] [4] [5] Zero Response Code 4 32 Question Count Answer Record Count 8 64 Authority Record Count Additional Record Count dns Question Count: Specifies the number of questions in the Question section of the message. Answer Record Count: Specifies the number of resource records in the Answer section of the message. Authority Record Count: Specifies the number of resource records in the Authority section of the message. Additional Record Count: Specifies the number of resource records in the Additional section of the message. [1] : Query/Response Flag [2] : Authoritative Answer Flag [3] : Truncation Flag [4] : Recursion Desired [5] : Recursion Available http://www.tcpipguide.com/free/t_DNSMessageHeaderandQuestionSectionFormat.htm

Bootstrap Protocol BOOTP BOOTP Format Offsets Octet 1 2 3 Bit  0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Operation Code Hardware type Hardware Address Length Hops 4 32 Transaction Identifier 8 64 Seconds [1] Reserved 96 Client IP Address 128 “Your” IP Address 160 Server IP Address 192 Gateway IP Address 224 Client Hardware Address 44 352 Server Name 108 864 Boot Filename 236 - 300 1888 2400 Vendor-Specific Area Bootp.dhcp [1] : Broadcast Flag http://www.tcpipguide.com/free/t_BOOTPMessageFormat.htm

Dynamic Host Configuration Protocol DHCP DNS Format Offsets Octet 1 2 3 Bit  0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Operation Code Hardware type Hardware Address Length Hops 4 32 Transaction Identifier 8 64 Seconds [1] Reserved 96 Client IP Address 128 “Your” IP Address 160 Server IP Address 192 Gateway IP Address 224 Client Hardware Address 44 352 Server Name 108 864 Boot Filename 236 … 1888 Options …. Bootp.dhcp [1] : Broadcast Flag http://www.tcpipguide.com/free/t_DHCPMessageFormat.htm

DHCP Simulation

Hypertext Transfer Protocol HTTP http.host==“website“

Reference

HTTP https://en.wikipedia.org/wiki/List_of_HTTP_status_codes https://tools.ietf.org/html/rfc7231 HTTP response status codes 1xx Informational responses 2xx Success 3xx Redirection 4xx Client errors 5xx Server errors