I opened Wireshark and selected the network interface that was being used by my computer. I started a packet capture and generated normal network traffic by accessing the test web application and performing other basic network activities.Wireshark displayed packets as they were transmitted and received. I examined information such as the source IP address, destination IP address, protocol, packet length and packet details.
TCP Analysis
I filtered the captured traffic to concentrate on TCP packets.
I examined the TCP three-way handshake:
- SYN – the client requested to establish a connection.
- SYN-ACK – the server responded and acknowledged the request.
- ACK – the client acknowledged the server’s response. .
This helped me understand how a TCP connection is established before data is exchanged.
DNS Traffic Analysis
I used a DNS display filter to identify DNS packets.
I examined DNS queries generated when the test system attempted to resolve domain names.
I observed the relationship between the DNS request and the corresponding response containing the resolved address.
This exercise demonstrated how DNS helps systems translate domain names into IP addresses.
HTTP Traffic Analysis
I filtered the captured traffic to identify HTTP packets generated by the test application.
I examined HTTP requests and responses, including request methods, response codes, headers and other available information.
I also used Wireshark’s stream-following functionality where appropriate to understand the communication between the client and server.
Using Wireshark Filters, I practiced using display filters to locate specific packets instead of manually examining the entire capture.
Examples of filters I used included:
- http
- dns
- tcp
- udpi
- cmp.
I also used IP-based filtering to concentrate on traffic involving particular test hosts.The filtering process made packet analysis faster and allowed me to investigate specific types of communication