Upload
others
View
4
Download
0
Embed Size (px)
Citation preview
©
L
T
O
B
R
P
S
© 2013 Cisco and
Lab - Us
Topology
Objectives
Part 1: Pr
Selec
Part 2: Ca
Captu
Locat
Exam
Backgroun
In this labthe Hypersuch as Hestablish the Internserver. A
Note: This
Required R
1 PC (Win
Part 1: P
In Part 1,
Step 1: Re
For this laalso called
a. Open
d/or its affiliates.
sing Wir
repare Wires
ct an appropri
apture, Loca
ure a web ses
te appropriate
mine informatio
nd / Scenar
b, you will userText Transfe
HTTP or File Ta reliable TCet, a three-waPC can have
s lab cannot b
Resources
ndows 7, Vist
Prepare W
you start the
etrieve the P
ab, you need td the MAC ad
a command
All rights reserve
eshark t
shark to Capt
ate NIC interf
ate, and Exam
ssion to www.
e packets for a
on within pac
rio
Wireshark tor Protocol (HTTransfer ProtoP session betay handshake multiple, sim
be completed
a, or XP with
Wireshark
Wireshark pr
PC interface
to retrieve yoddress.
prompt windo
ed. This docume
to Obse
ture Packets
face to captur
mine Packets
.google.com.
a web sessio
kets, includin
o capture andTTP) and a wocol (FTP) firstween the twoe is initiated a
multaneous, ac
d using Netlab
a command
k to Captu
rogram and se
e addresses
ur PC’s IP ad
ow, type ipco
ent is Cisco Publi
erve the
s
re packets.
s
n.
g IP addresse
examine pacweb server, sust starts on a o hosts. For eand a sessionctive TCP ses
b. This lab ass
prompt acces
ure Packe
elect the app
s.
ddress and its
onfig /all and
ic.
TCP 3-W
es, TCP port
ckets generatuch as www.ghost, TCP us
example, when is establishessions with va
sumes that yo
ss, Internet ac
ets
ropriate interf
s network inte
then press E
Way Han
numbers, an
ted between tgoogle.com. Wses the three-en a PC uses ed between tharious web sit
ou have Inter
ccess, and W
face to begin
erface card (N
Enter.
ndshake
d TCP contro
the PC browsWhen an appl-way handshaa web brows
he PC host antes.
rnet access.
Wireshark insta
capturing pa
NIC) physical
Page 1 of 6
e
ol flags.
ser using lication, ake to ser to surf nd web
alled)
ckets.
address,
L
©
S
Lab - Using W
© 2013 Cisco and
b. Write sourc
The P
The P
Step 2: Sta
a. Click
b. After W
c. In theyour L
Wireshark to
d/or its affiliates.
down the IP ce address to
PC host IP ad
PC host MAC
art Wiresha
the Windows
Wireshark sta
e Wireshark: LAN.
Observe the
All rights reserve
and MAC addlook for when
dress:
address:
rk and sele
Start button
arts, click Inte
Capture Inte
e TCP 3-Way
ed. This docume
dresses asson examining c
ct the appro
and on the p
erface List.
erfaces windo
y Handshake
ent is Cisco Publi
ciated with thcaptured pack
opriate inte
op-up menu,
ow, click the c
e
ic.
he selected Etkets.
erface.
double-click
check the box
thernet adapt
Wireshark.
x next to the i
ter, because t
nterface conn
Page 2 of 6
that is the
nected to
L
©
P
S
S
Lab - Using W
© 2013 Cisco and
Note:802.3the In
Part 2: C
Step 1: Cli
a. Go toYou s
Note:here:
b. The c
Step 2: Lo
If the comentire proSystem (Dpackets thdefault ga
a. Framewww.send
What
b. Frame
c. Find tstart o
Wireshark to
d/or its affiliates.
If multiple int3 (Ethernet) taterface Detai
Capture, L
ck the Start
www.googleshould see ca
Your instruct
capture windo
cate approp
mputer was reccess in the caDNS), and thehe computer mateway; theref
e 11 shows thgoogle.com tthe first pack
is the IP add
e 12 is the res
the appropriatof the TCP th
Observe the
All rights reserve
terfaces are lab, and verifyls window aft
Locate, a
t button to s
.com. Minimizaptured traffic
tor may provi
ow is now acti
priate packe
cently startedaptured outpue TCP three-wmust get to wfore, it started
he DNS queryto the IP addret to the web
ress of the D
sponse from
te packet for ree-way hand
e TCP 3-Way
ed. This docume
isted and youy that the MACter verification
nd Exam
start the da
ze the Googlesimilar to tha
de you with a
ve. Locate th
ets for the w
d and there haut, including thway handsha
www.google.cod with the DN
y from the PCress of the weserver.
NS server tha
the DNS serv
the start of yodshake.
y Handshake
ent is Cisco Publi
u are unsure wC address man.
mine Pack
ata capture.
e window, andat shown belo
a different web
e Source, De
web sessio
as been no ache Address Rke. The captuom. In this caS query to re
C to the DNS seb server. The
at the comput
ver with the IP
our three-way
e
ic.
which interfacatches what y
kets
d return to Wow in step b.
bsite. If so, en
estination, a
n.
ctivity in acceResolution Proure screen in ase, the PC alsolve www.go
server, atteme PC must ha
ter queried?
P address of w
y handshake.
ce to check, cyou wrote dow
Wireshark. Sto
nter the webs
nd Protocol
essing the Inteotocol (ARP),Part 2, Step lready had anoogle.com.
mpting to resolave the IP add
www.google.c
In this examp
click Details. wn in Step 1b
p the data ca
site name or a
columns.
ernet, you can Domain Nam1 shows all thn ARP entry f
lve the domadress before
com.
ple, frame 15
Page 3 of 6
Click the b. Close
apture.
address
n see the me he for the
in name, it can
5 is the
L
©
S
Lab - Using W
© 2013 Cisco and
What
d. If youWires
Step 3: ExTC
a. In ourserveand dinform
b. Click view o
c. Click
Note:neces
Wireshark to
d/or its affiliates.
is the IP add
have many pshark filter cap
amine inforCP control fl
r example, frar. In the packisplays the de
mation in the p
the + icon to of the TCP inf
the + icon to
You may havssary informa
Observe the
All rights reserve
ress of the G
packets that apability. Enter
rmation withlags.
ame 15 is the ket list pane (tecoded informpacket details
the left of theformation.
the left of the
ve to adjust thtion.
e TCP 3-Way
ed. This docume
oogle web se
are unrelated r tcp in the filt
hin packets
start of the thtop section ofmation from ths pane (middle
e Transmissio
e Flags. Look
he top and m
y Handshake
ent is Cisco Publi
erver?
to the TCP coter entry area
s including
hree-way hanf the main winhat packet in e section of th
n Control Pro
at the source
iddle window
e
ic.
onnection, it a within Wires
IP addresse
ndshake betwndow), select the two lowerhe main wind
otocol in the p
e and destinat
ws sizes within
may be neceshark and pre
es, TCP por
ween the PC athe frame. Thr panes. Exam
dow).
packet details
tion ports and
n Wireshark to
ssary to use tess Enter.
rt numbers,
and the Googhis highlights mine the TCP
s pane to expa
d the flags tha
o display the
Page 4 of 6
the
, and
le web the line
P
and the
at are set.
L
©
Lab - Using W
© 2013 Cisco and
What
How w
What
How w
Which
What
d. To sePackeinitial
What
Wireshark to
d/or its affiliates.
is the TCP so
would you cla
is the TCP d
would you cla
h flag (or flags
is the relative
elect the next et In Conversrequest to sta
are the value
Observe the
All rights reserve
ource port nu
assify the sou
estination por
assify the des
s) is set?
e sequence n
frame in the tsation. In thisart a session.
es of the sour
e TCP 3-Way
ed. This docume
mber?
rce port?
rt number?
tination port?
umber set to?
three-way hans example, th.
rce and destin
y Handshake
ent is Cisco Publi
?
?
ndshake, selehis is frame 16
nation ports?
e
ic.
ect Go on the6. This is the
e Wireshark mGoogle web
menu and seleserver reply t
Page 5 of 6
ect Next to the
L
©
R
1
2
Lab - Using W
© 2013 Cisco and
Which
What
e. Finallywindo
Exam
Which
The reconnebegin
f. Close
Reflection
1. There aredifferent ty
2. What othe
Wireshark to
d/or its affiliates.
h flags are se
are the relati
y, examine thow displays th
mine the third a
h flag (or flags
elative sequeection is now .
e the Wiresha
e hundreds of ypes of traffic
er ways could
Observe the
All rights reserve
et?
ve sequence
he third packehe following in
and final pack
s) is set?
ence and acknestablished, a
rk program.
filters availabc. Which three
d Wireshark b
e TCP 3-Way
ed. This docume
and acknowl
et of the threenformation in
ket of the han
nowledgemenand commun
ble in Wireshae filters in the
e used in a p
y Handshake
ent is Cisco Publi
edgement nu
e-way handshthis example:
ndshake.
nt numbers arication betwe
ark. A large nlist might be
production net
e
ic.
umbers set to
ake in the ex:
re set to 1 as een the source
network could the most use
twork?
?
xample. Clicki
a starting poe computer a
have numeroeful to a netwo
ng frame 17 i
int. The TCP and the web s
ous filters andork administra
Page 6 of 6
in the top
server can
d many ator?