NETW202, Robert Meadows
Current Date 3-15-15
iLab #2, Introduction to Wireshark
Section I: Watch the video on the iLab page about Wireshark and answer the questions below.
1. Is Wireshark open source or proprietary? What does it mean to be open source versus proprietary in the first place? Give an example of something that is open source versus something that is proprietary in the field of networking and telecommunications. (1 point) Wireshark is Open Source. Open-source software (OSS) is computer software with its source code made available with a license in which the copyright holder provides the rights to study, change and distribute the software to anyone and for any purpose
2. What is seen in each of the three panes that display the packets seen on a local area network? Hint: For full credit, you must talk about what is displayed in each pane in addition to the name of each pane. (1 point) Tree view pane- allows the hierarches view of the header view details Byte view pane- raw data 10x bytes per row.
Packet list pane- shows packets and the information on each packet, that is separated info columns 3. What does a display filter do? Where do you add in a display filter? (1 point) Allows you to define which packets are displayed in the list pane. You would add it into the filter fields.
4. What does the protocol column show? How can this be helpful to you when troubleshooting? (1 point) This column shows the protocol that the packet is using. It would be useful when trying to decide if the proper protocol is being used and if it is causing a conflict which could shut the system or program down.
5. How do you expand the details in a layer of the packet in the middle frame? What is shown when you expand the details of a packet? (1 point) By clicking the (+) sign. The protocol the packet is using as well as the packet information.
6. Wireshark capture files have what file name extension? (1 point) pcapng
7. The time column shows what? The time is displayed in what part of a second (sec, msec, usec, etc.)? (1 point) Time stamps for each packet, the display is defaulted at microseconds
8. What happens when you right-click on something in one of the panes? (1 point) It will bring up a “context menu”
9. How is a display filter removed? (1 point)
Edit > Preferences > Filter Expressions. Select the filter you no longer want and click Remove.
10. When a filter is correct, what color is the background of the filter window? (1 point) Green
Section II: Go to www.wireshark.org and look at the documents page http://www.wireshark.org/docs/. Select one of the network mysteries “Cases” videos to watch and comment on.
1. Write a paragraph of at least seven sentences about the case you choose and what you learned about Wireshark and network troubleshooting from that case. (4 points)
I looked at the Case of the Missing File. Betty was the “detective and she described a customer calling in due to a missing trace file. She uses Merge cap to look for trends and piolets. Betty describes that she was called in for response time. Opening client side round trip time. She discovers the server with over one second response time. The file is missing and it shows no data. I learned that if there is an issue with this you can hover over the name and it will give you the information you need pertaining to the title. I also learned that only certain protocols are calculated by default.
Section III: Download Wireshark and some supporting documents. (You will need this for the Week 3 iLab).
1.Download the appropriate user guide for your downloaded version of Wireshark. Which version did you download? (1 point) Windows Installer (64-bit)
2. What version of Wireshark did you download? Show a screenshot of the version that you downloaded (as in the graphic above) (2 points). You are now ready to work on the next Wireshark iLab in Week...
Please join StudyMode to read the full document