Upload
others
View
5
Download
0
Embed Size (px)
Citation preview
Lab1:PacketSniffingandWireshark
FengweiZhang
WayneStateUniversity Course:CyberSecurityPractice 1
PacketSniffer• Packetsnifferisabasictoolforobservingnetworkpacketexchangesinacomputer
• Capturing(“sniffs”)packetsbeingsent/receivedfrom/byyourcomputer
• Apacketsnifferitselfispassive
• Displayingthecontentsofthevariousprotocolfieldsinthesecapturedpackets,butneversendingpacketsitself
WayneStateUniversity Course:CyberSecurityPractice 2
PacketSnifferStructure
WayneStateUniversity Course:CyberSecurityPractice 3
PacketSniffer(cont’d)• Applications(webbrowsers,FTPclients,emailclients)
• Networkprotocols(Internetprotocol)
• Packetcapture– Thepacketcapturelibraryreceivesacopyofeverylink-layerframe
thatissentfromorreceivedbyyourcomputer
• PacketAnalyzer– Displayingthecontentsofallfieldswithinaprotocolmessage– Understandingthestructureofallmessagesexchangedbyprotocols– IP,TCP,HTTPheaders
• Wireshark,TCPDump
WayneStateUniversity Course:CyberSecurityPractice 4
TCP/IPNetworkStack• TCP/IPisthemostcommonlyusednetworkmodelfor
Internetservices.
• Becauseitsmostimportantprotocols,theTransmissionControlProtocol(TCP)andtheInternetProtocol(IP)werethefirstnetworkingprotocolsdefinedinthisstandard,itisnamedasTCP/IP.
• Itcontainsmultiplelayersincluding:– Applicationlayer– Transportlayer– Networklayer– Datalinklayer
WayneStateUniversity Course:CyberSecurityPractice 5
AnExampleLayeredApproach
WayneStateUniversity Course:CyberSecurityPractice 6
NetworkLayers
WayneStateUniversity Course:CyberSecurityPractice 7
ApplicationLayer
• Theapplicationlayerincludestheprotocolsusedbymostapplicationsforprovidinguserservices
• ExamplesofapplicationlayerprotocolsareHypertextTransferProtocol(HTTP),SecureShell(SSH),FileTransferProtocol(FTP),andSimpleMailTransferProtocol(SMTP)
WayneStateUniversity Course:CyberSecurityPractice 8
TransportLayer• Thetransportlayerestablishesprocess-to-process
connectivity,anditprovidesend-to-endservicesthatareindependentofunderlyinguserdata.
• Toimplementtheprocess-to-processcommunication,theprotocolintroducesaconceptofport.TheexamplesoftransportlayerprotocolsareTransportControlProtocol(TCP)andUserDatagramProtocol(UDP).
• TheTCPprovidesflowcontrol,connectionestablishment,andreliabletransmissionofdata,whiletheUDPisaconnectionlesstransmissionmodel.
WayneStateUniversity Course:CyberSecurityPractice 9
InternetLayer• TheInternetlayerisresponsibleforsendingpacketstoacrossnetworks.
• Ithastwofunctions:1)HostidentificationbyusingIPaddressingsystem(IPv4andIPv6);and2)packetsroutingfromsourcetodestination.
• TheexamplesofInternetlayerprotocolsareInternetProtocol(IP),InternetControlMessageProtocol(ICMP),andAddressResolutionProtocol(ARP).
WayneStateUniversity Course:CyberSecurityPractice 10
LinkLayer
• Thelinklayerdefinesthenetworkingmethodswithinthescopeofthelocalnetworklink.
• Itisusedtomovethepacketsbetweentwohostsonthesamelink.AncommonexampleoflinklayerprotocolsisEthernet.
WayneStateUniversity Course:CyberSecurityPractice 11
DataEncapsulationinNetworkStack
WayneStateUniversity Course:CyberSecurityPractice 12
Lab0
• MakesureyoucanloginasCSC5290studentonZeroClient– UsingyourWSUaccessIDandpassword– ProvidingVMimagesforlabexperiments
WayneStateUniversity Course:CyberSecurityPractice 13
Lab0(cont’d)• Subscribecoursemailing-list– [email protected]– ListHomepage(webinterfaceforsubscriberstojoin/leavelist,postmessages,viewarchives):http://lists.wayne.edu
• Sendanemailtothelisttointroduceyourselfbynextclass
• Sendazippedtest.txtfileonBackboardbythisweek
WayneStateUniversity Course:CyberSecurityPractice 14