Exercises ARP ICMP DNS HTTP/TCP Trace analysis

ARP launch Wireshark ipconfig /all ; see local IP and gateway route -print ; find gateway arp -a ; list all MAC addresses learned arp -d * ; delete all MAC address learned ping What is the MAC address of the router? 2

Hints If the default gateway/router’s MAC address is not in the cache, the host will send ARP to ask for it. The default gateway’s IP address is pre- configured or learnt through the DHCP protocol. 3

ICMP ping – htm htm – What is the value of ‘Type’ in the outgoing ICMP packet? – What is the value of ‘Type’ in the incoming ICMP packet? – Take a look at the data section in the incoming ICMP packet. tracert – What are the answers to the above two questions? 4

Hints Ping – Send: ICMP Echo Request – Receive: ICMP Echo Reply Traceroute – Send: And kind of IP packet with special TTL It would be an ICMP packet if we need the reply from the destination – Receive: ICMP Time Exceeded 5

DNS nslookup Take a look at DNS query and response packets nslookup set type=PTR Take a look at DNS query and response packets 6

Hints set type=A (default setting) – Normal DNS lookup: get the IP address from a host name set type=PTR – Reverse DNS lookup: get the host name from its IP address 7

HTTP/TCP Use browser to visit Take a look at – TCP’s three-way handshake – sequence numbers in packets from the server and the acknowledgement number in packets from the client – HTTP header in the packet from the client – HTTP header in the packets from the server 8

Trace analysis Real trace from a VoIP hacking demo Analyze the trace using Wireshark and answer the following questions – Which 4 protocols are involved in the pcap? – Which codec does the RTP stream use? – How did the attacker gain access to the server? – Where is the hacked server? Tips: look into the payload 9

Hints 4 Protocols: HTTP, RTP, RTCP, SIP RTP uses G.7111 PCMU coding Default user name/password – Authorization: Basic bWFpbnQ6cGFzc3dvcmQ= The city is DISTRITO FEDERAL MEXICO – Hear it Telephony -> RTP -> Stream analysis – Public IP: in an HTTP response Follow HTTP connections Look into the HTTP responses Use Geolocation websites to locate the city 10

Useful links Protocols – 1.htm 1.htm Wireshark – guide-a4.pdf TCPDump –