Preface iii
Acknowledgments viii
Section 1: Getting Started 1
Introduction 1
Exercise 1.1 Examining a Quiet Network 2
Introduction 2
Configuration 3
Experiment 3
Using the Capture Options Dialog 6
Examining a Short Trace 9
List, Protocol, and Raw Panes 10
Trace Summary Statistics 12
Questions 14
Discussion and Investigation 14
Resources 15
Exercise 1.2 Protocol Layering 16
Introduction 16
Configuration 19
Experiment 19
Protocol Hierarchy Statistics 20
TCP Connection 20
Frame Layer 22
Ethernet Layer 23
Internet Protocol Layer 25
Transport Control Protocol 26
Packet Overview 27
UDP Packets 27
Questions 27
Discussion and Investigation 28
Resources 29
Exercise 1.3 Examining a Busy Network Using Filters 30
Introduction 30
Configuration 31
Experiment 32
Capture Filters 32
Color Filters 34
Display Filters 38
Searching for Packets 39
Questions 39
Discussion and Investigation 40
Resources 40
Section 2: Application Layer Protocols 42
Introduction 42
Exercise 2.1 Under the Hood of HTTP 44
Introduction 44
Configuration 46
Experiment 47
HTTP Get Request 48
HTTP Response 50
Multiple GET Requests per URL 50
Plain Text Data 51
Multiple TCP Streams 54
Questions 54
Discussion and Investigation 55
Resources 56
Exercise 2.2 HTTP Caching,Authorization and Cookies 57
Introduction 57
Configuration 57
Experiment 58
Cookies 58
Authorization Headers 59
Caching Headers 61
Questions 63
Discussion and Investigation 64
Resources 64
Exercise 2.3 FTP - File Transfer Protocol 65
Introduction 65
Configuration 66
Experiment 67
Control Channel 67
Data Channels 71
Questions 73
Discussion and Investigation 74
Resources 75
Exercise 2.4 Sending and Receiving Email with SMTP and POP 76
Introduction 76
Configuration 77
Experiment 78
Outgoing Mail 78
Incoming Mail 81
E-mail Headers 82
No Mail 84
Questions 85
Discussion and Investigation 86
Resources 86
Section 3: Transport Layer Protocols 88
Introduction 88
Exercise 3.1 Introduction to TCP 90
Introduction 90
Configuration 92
Experiment 93
Local TTCP Connection 93
Connection Establishment 94
One-way Data Flow 96
Closing a Connection 97
Connection Statistics 97
Remote SSH Connection 98
Questions 99
Discussion and Investigation 99
Resources 101
Exercise 3.2 Retransmission in TCP 102
Introduction 102
Configuration 103
Experiment 104
Local TTCP Connection 104
SACK Option Negotiated 105
Missing Packets and Retransmission 107
Impact on Sending Rate 109
Remote TTCP Connection 111
Questions 112
Discussion and Investigation 113
Resources 114
Exercise 3.3 Comparing TCP to UDP 115
Introduction 115
Configuration 117
Experiment 117
Using TTCP To Generate TCP and UDP
Traffic 118
Normal Data Transfer In TCP 119
Normal Data Transfer In UDP 120
No Receiver Present for TCP and UDP 122
Questions 123
Discussion and Investigation 124
Resources 125
Exercise 3.4 Competing TCP and UDP Streams 126
Introduction 126
Configuration 127
Experiment 128
Two Competing TCP Streams 128
UDP Competing with TCP 132
Two Competing UDP Streams 133
Questions 135
Discussion and Investigation 136
Resources 136
Section 4: Network Layer Protocols 137
Introduction 137
Exercise 4.1 Joining the Internet: Introduction to IP and DHCP 139
Introduction 139
Configuration 142
Experiment 143
Obtaining an IP Address Via DHCP 143
Fragmentation in IPv4 146
Ping Over IPv6 149
Questions 151
Discussion and Investigation 151
Resources 152
Exercise 4.2 Ping and Traceroute 153
Introduction 153
Configuration 156
Experiment 157
Local and Remote Pings 157
Local Traceroute 159
Remote Traceroute 162
Questions 163
Discussion and Investigation 164
Resources 164
Exercise 4.3 Dynamic Routing with RIP 166
Introduction 166
Configuration 168
Experiment 170
No RIP Enabled 170
RIP Enabled on the Endpoints 170
RIP Enabled on All Machines But One 171
RIP Enabled End-to-End 175
Adding a Loop in the Network Graph 177
Adjusting to a Failed Link 178
Open Shortest Path First 178
Questions 180
Discussion and Investigation 181
Resources 181
Exercise 4.4 Border Gateway Protocol 182
Introduction 182
Configuration 184
Experiment 186
Establishing BGP Peering Sessions 186
Withdrawing a Route 188
Repairing a Connection 191
Questions 193
Discussion and Investigation 193
Resources 194
Section 5: Link Layer Protocols 195
Introduction 195
Exercise 5.1 MAC Addresses and the Address Resolution Protocol 197
Introduction 197
Configuration 200
Experiment 201
Address Resolution Protocol 201
MAC Address Spoofing 203
Questions 207
Discussion and Investigation 208
Resources 208
Exercise 5.2 Ethernet 209
Introduction 209
Configuration 213
Experiment 214
Ethernet Switch 214
Ethernet Hub 216
Questions 217
Discussion and Investigation 219
Resources 219
Exercise 5.3 Wireless LANs 220
Introduction 220
Configuration 226
Experiment 227
Beacon Frames 227
WEP Disabled 229
Contents xi
Data Frames 231
WEP Enabled 232
Questions 233
Discussion and Investigation 234
Resources 234
Section 6: Security 235
Introduction 235
Exercise 6.1 Encryption 236
Introduction 236
Configuration 238
Experiment 239
Plain Text Telnet Session 239
Encrypted SSH Session 240
Attacks Against SSH 242
Comparing HTTP and HTTPS 243
Questions 246
Discussion and Investigation 247
Resources 248
Exercise 6.2 IP Spoofing and TCP Session Stealing 249
Introduction 249
Configuration 250
Experiment 251
TCP Session Hijacking 252
TCP Session Termination 256
Questions 257
Discussion and Investigation 257
Resources 258
Exercise 6.3 System Vulnerabilities 259
Introduction 259
Configuration 261
Experiment 262
Port Scans 262
Blaster Worm 265
Questions 267
Discussion and Investigation 268
Resources 268
Index 269
