In this lab, you will learn network analysis techniques using Wireshark, the industry-standard network protocol analyzer. This powerful tool enables you to examine network traffic at the packet level, providing valuable insights for troubleshooting and security analysis.
You will gain practical skills in capturing, filtering, and interpreting network packets. Through hands-on exercises, you'll understand how different protocols communicate and identify potential network issues.
In this step, we'll install Wireshark on our Ubuntu system. Wireshark is a network protocol analyzer that lets you capture and interactively browse network traffic. It's available in the default Ubuntu repositories, making the installation process straightforward for beginners.
Note: Free users can't connect to the internet, so Wireshark is already pre-installed in the lab environment, You can jump to item 5 in the list (check if Wireshark is installed). Upgrade to a pro user to practice installing Wireshark by yourself.
sudo apt update-y flag automatically answers "yes" to any prompts during installation, making the process smoother:sudo apt install wireshark -y
wireshark --versionwireshark group and setting up Dumpcap (Wireshark's packet capture tool) with the right permissions:First, check if the wireshark group exists (it should have been created during installation):
getent group wiresharkIf for some reason the group doesn't exist, create it with:
sudo groupadd wiresharkThese commands configure Dumpcap to run with elevated privileges while keeping Wireshark itself running as a normal user - a security best practice:
sudo chgrp wireshark /usr/bin/dumpcap
sudo chmod 4755 /usr/bin/dumpcap
sudo gpasswd -a $USER wiresharkAfter running these commands, you'll need to log out and back in for the group changes to take effect. You've now successfully installed and configured Wireshark, ready to start analyzing network traffic!
Now that we have Wireshark installed, let's capture some network traffic. Think of this like setting up a microphone to record all conversations happening on your network. Every time your computer sends or receives data online, it's broken down into small pieces called packets. Wireshark lets us see and analyze these packets.
Open Wireshark by typing wireshark in the terminal and pressing Enter. This launches the graphical interface where we'll do our packet capturing.
When Wireshark opens, you'll see a list of network interfaces (the connections your computer uses to talk to networks). Look for an interface named "eth0" or "eth1" - these are typically your wired Ethernet connections. If you're using WiFi, you might see "wlan0" instead.
Let's create some simple network activity to capture. Open a new terminal window and enter:
curl http://example.comThis command fetches the homepage of example.com, generating HTTP packets (web traffic) that Wireshark can capture. You'll see new packets appear in Wireshark immediately after running this.
After seeing several packets (about 5-10 seconds is enough), click the red "Stop" button at the top. This freezes the capture so we can examine the packets without new ones constantly arriving.
Congratulations! You've captured your first network traffic. Each line represents a packet with details like source/destination addresses, protocol type, and timing. The three main panels show: the packet list (summary), packet details (technical breakdown), and raw packet data (hexadecimal view).
To save your work, go to File > Save and name the file myfirstcapture.pcapng in /home/labex. The .pcapng format preserves all the packet details for future analysis.
This basic capture process is the foundation of network analysis. In upcoming steps, we'll learn how to filter and interpret these packets to understand network behavior and troubleshoot issues.
Now that we've captured some network traffic, let's examine it step by step. Think of this like reading a digital conversation - we'll learn how to interpret the "language" computers use to communicate.
Opening the Capture File:
Start Wireshark and open your saved capture file (myfirstcapture.pcapng) either through File > Open or by double-clicking the file. This file contains all the network traffic we previously recorded, similar to a recording of phone calls.
Understanding the Packet List:
The top pane shows all captured packets in chronological order. Each line represents one network message, showing:
Examining Packet Details:
When you click any packet, the middle pane reveals its internal structure through protocol layers:
Filtering HTTP Traffic:
In the filter bar (top), type http and press Enter. This isolates web traffic, just like searching for only text messages in a phone log. HTTP is the protocol web browsers use to communicate with servers.
Analyzing HTTP Headers:
Expand the "Hypertext Transfer Protocol" section to see:
Finding Server Responses:
Search for "HTTP/1.1 200 OK" packets. These show successful webpage deliveries. Notice:
This analysis reveals the hidden conversations happening across networks. By understanding these patterns, you can troubleshoot issues, identify suspicious activity, and comprehend how applications communicate.
Wireshark's real power comes from its ability to filter and analyze large amounts of network data quickly. In this step, we'll learn how to use filters to focus on specific types of traffic. Think of filters as search terms that help you find exactly what you're looking for in a sea of network packets.
With your capture file open in Wireshark, let's start by using some simple display filters. The filter bar is located just below the main toolbar:
tcp in the filter bar and press Enter. This will hide all non-TCP packets from view.ip.addr == 93.184.215.14 (this is the IP address of example.com, but you can replace it with any IP address you see in your capture). The double equals sign (==) means "exactly matches".
http.request.method == "GET". This helps you see what web pages are being requested.Now let's create a more complex filter by combining conditions. We'll look for all HTTP GET requests specifically going to example.com:
http.request.method == "GET" && http.host contains "example.com"&& means "AND", so both conditions must be truecontains operator lets us match any domain with "example.com" in it
Since you'll likely use certain filters repeatedly, Wireshark lets you save them. Let's save our HTTP GET filter:
Finally, let's export some of our findings for documentation or further analysis:
/home/labex as the location and save the file as http_requests.txt
Using filters in this way allows you to quickly sift through large amounts of network data and focus on what's important. It's like having a super-powered magnifying glass that can instantly show you specific types of network traffic. Mastering filters will save you hours when troubleshooting network issues or analyzing security events.
In this lab, you have learned the fundamentals of network analysis using Wireshark. You've mastered essential skills including installing Wireshark, capturing network traffic, analyzing packet data, and applying filters to isolate specific traffic types.
These core competencies provide a solid foundation for cybersecurity and network administration. Wireshark serves as a powerful tool for troubleshooting networks, monitoring traffic patterns, and identifying potential security threats. Continue practicing to further develop your network analysis expertise.
