ITECH1003/ITECH5003 Networking Assignment: Wireshark and Traffic Capture Basics

ITECH1003/ITECH5003 Networking Assignment

Contents
Part 1 – Wireshark and traffic capture basics..................................................................................3
Part 2: Capture filters.......................................................................................................................7
Documenting the 3: Logical operators for combining primitives...................................................9

Part 1 – Wireshark and traffic capture basics
1.1:
Solution: The network traffic capturing is used to analyze and study the behaviour of the entire
network infrastructure. There are two ways the network traffic capturing is done one is active
capturing and other is promiscuous mode capturing.
In promiscuous mode, the NIC interface is instructed to listen to each and every packet and
report it to the Wireshark or similar tool. The NIC interface silently listens every packet which is
intended to this machine or not.
1.2:
Solution: In Wireshark, there is various option available but most important setting is available
in the Capture> Options dialogue box. In this, we can use the Name Resolution of the Network
Layer names. Which resolve IP address in the network name which is assigned to the DNS
server. Given below is the snapshot of it.
1.3:
Solution: The network technologies have been evolved a lot in the last two decades. But the
basic networking starts in the LAN environment. So in order to provide the LAN communication
among different computer and server, we need to have a network device. Initially, there is only
HUB available after that the network switch is developed using the bridge technology.
The network switch limits the broadcast of the packet by using a specialized algorithm for
processing the network traffic based on MAC address of the Ethernet frames. While the Hub

receives the copy of the packet and retransmits it on all the connected port even from the
receiving devices.
Figure 1: Network switch working
That’s why most of the time network engineer termed the Hub as the dumb device. But the
network work initially similarly like the hub but it will learn some network information and then
smartly processes the network traffic in the switched network.
Figure 2: Working of HUB
Now we know that the hub network will retransmit each and every packet in the network to
every connected device. The network engineer understands this so if he put the Wireshark in the