Network Analysis using Wireshark

This report compares the performance of two websites using Wireshark and identifies network issues and vulnerabilities. It includes a comparison of Microsoft Message Analyzer and Wireshark, and provides statistics on packet loss, retransmission, and throughput.

Running head: NETWORKED APPLICATION MANAGEMENT
Network Analysis using Wireshark
Name of the Student
Name of the University
Author’s Note

1
NETWORKED APPLICATION MANAGEMENT
Table of Contents
Introduction...........................................................................................................................................2
Part 1:....................................................................................................................................................2
Part 2:....................................................................................................................................................7
Part 3...................................................................................................................................................12
Part 4...................................................................................................................................................15
Conclusion...........................................................................................................................................18

2
NETWORKED APPLICATION MANAGEMENT
Introduction
The report is prepared for the analysing and comparing the performance of two websites
https://www.abc.net.au/news/, https://iview.abc.net.au/ using wireshark. The different network
issues and the networked application that can be used for analysing the system performance are
identified and improving the quality of service. A research is made on the usability of wireshark for
identification of the networking protocol and analysing the flow of data traffic in the network.
Different network is used for analysing the performance of the website and identification of the
vulnerability acting on the system using wireshark. It helps in identification of the packet loss and the
IP address of the client and server. The quality of service that can be achieved using the wireshark
application is analysed by analysing the name resolution-network address, retransmission and the
packet loss during surfing the website. The packet loss is identified from the generation of the
throughput graph and application of tcp.analysis.lost_segment filter in wireshark. The statistics
collected from wireshark is collected and compared with each other for the identification of the
network performance. Along with wireshark Microsoft Message Analyzer is used and its usability is
compared by analysing its ease of access, GUI, visualization of traffic and statistics generation.
Part 1:
Network 1:
1. Start time of capture
The start time of capture of the data packet is Jan 20, 2019 13:14:42.464581000.

3
NETWORKED APPLICATION MANAGEMENT
2. Total number of capture packet for each protocol
The total number of captured packet for the first pcap file is 2190 packets
3. Total Number of lost packets

4
NETWORKED APPLICATION MANAGEMENT
0 packet is lost while connecting with the two website and it is analysed by applying the filter
tcp.analysis.lost_segment in the wireshark packet capture file.
4. IP addresses of the client and server
The IP address of the source machine is 10.10.30.142 and the Ip address of the destination server is
8.8.8.8.
Network 2:
1. Start time of capture

5
NETWORKED APPLICATION MANAGEMENT
The start time for capturing the data packet flowing in the network is identified from the time
section of summary and it is given below:
Time
First packet: 2019-01-20 14:32:43
Last packet: 2019-01-20 14:33:24
Elapsed: 00:00:41
2. Total number of capture packet for each protocol
The total number of packet captured from each of the protocol is identified from the summary
report generated from wireshark and it can be found under the statistics section.
3. Total Number of lost packets
0 number of packets are lost in the network and it is identified from the interface section of the pcap
summary report generated in wireshark.
4. IP addresses of the client and server

6
NETWORKED APPLICATION MANAGEMENT
The following is the Ip address of the client and server Internet Protocol Version 4, Src: 172.30.4.46,
Dst: 8.8.4.4 identified from the packet captured from the second network.
Network 3:
1. Start time of capture
The start time of capturing the packet is given below:
First packet:
2019-01-20 14:34:59
Last packet:
2019-01-20 14:35:39
Elapsed:
00:00:39
2. Total number of capture packet for each protocol

7
NETWORKED APPLICATION MANAGEMENT
The total number of packets captured can also be found from the wireshark summary and it is given
below:
Packets
5889
3. Total Number of lost packets
The number of packets lost in the network is unknown and it is needed to be analysed for the pcap
file captured using the wireshark.
4. IP addresses of the client and server
The IP address of the source and destination address is Internet Protocol Version 6, Src:
2404:a800:0:14::1:1010 (2404:a800:0:14::1:1010), Dst: 2401:4900:314e:a39d:c93:ea02:b17c:8bd1
(2401:4900:314e:a39d:c93:ea02:b17c:8bd1).
Part 2:
Network 1
1. Name Resolution-Network Address

8
NETWORKED APPLICATION MANAGEMENT
For displaying the resolution-network address the view option is selected and from there the
Resolve network Addresses is checked for displaying the network addresses instead of the physical
addresses.

9
NETWORKED APPLICATION MANAGEMENT
2. Retransmission
For displaying the packets retransmitted in the network the filter tcp.analysis.retransmission is
applied in the packet captured and it shows that none of the packet is retransmitted since no packet
is lost in the network.
3. Packet Loss
0 packet is lost while connecting with the two website and it is analysed by applying the filter
tcp.analysis.lost_segment in the wireshark packet capture file.
Network 2
1. Name Resolution-Network Address

10
NETWORKED APPLICATION MANAGEMENT
For displaying the resolution-network address the view option is selected and from there the
Resolve network Addresses is checked for displaying the network addresses instead of the physical
addresses.
2. Retransmission
For displaying the packets retransmitted in the network the filter tcp.analysis.retransmission
is applied in the packet captured and it shows that packet number 717, 1662, 1821, 2487 and 3202 is
retransmitted since packet are lost in the network.
3. Packet Loss
1 packet is lost while connecting with the two website and it is analysed by applying the filter
tcp.analysis.lost_segment in the wireshark packet capture file.
Network 3
1. Name Resolution-Network Address

11
NETWORKED APPLICATION MANAGEMENT
For displaying the resolution-network address the view option is selected and from there the
Resolve network Addresses is checked for displaying the network addresses instead of the physical
addresses.
2. Retransmission
For displaying the packets retransmitted in the network the filter tcp.analysis.retransmission is
applied in the packet captured and it shows that 86 number of packet is retransmitted since there is
packet lost in the network and the network is unstable.
3. Packet Loss

12
NETWORKED APPLICATION MANAGEMENT
35 packet is lost while connecting with the two website and it is analysed by applying the filter
tcp.analysis.lost_segment in the wireshark packet capture file. The increase in packet loss in the
network increases the need of retransmission of data packet in the network.
Part 3
A comparison is made on the by running the two website application is three different
network and it is found the first network is more stable when compared with the other two
networks. No data packets are lost in the first network and thus there is no need of retransmission
of data packet and thus less number of data traffic is generated in the network. The second network
is less stable than the first network and it is an open network and is vulnerable to different types of
attacks. The third network is a home network and unstable and has more packet loss and needs
more retransmission of data packets. For the analysis of the performance of the network a
throughput graph is generated from the pcap file that shows its stability and the
tcp.analysis.retransmission filter is applied for the generation of the network retransmission graph.
Network 1
Throughput Graph

13
NETWORKED APPLICATION MANAGEMENT
Since there are no packet loss and data retransmitted in the network the network is considered as a
stable network and no graph can be generated for the retransmitted data packet.
Network 2
Throughput Graph
The following throughput graph is generated from the pcap file for the lost packet in the network
From the above graph it is identified that the maximum throughput of the network is of around 1400
bytes and it is displayed for a segment of 0 to 1400 byte length.

14
NETWORKED APPLICATION MANAGEMENT
Network Retransmission Statistics
From the above network retransmission statistic graph it is identified that the network is stable and
the number of sequence flows from 7000 for a time span of 17.5 second.
Network 3
Throughput Graph
The following throughput graph is generated from the pcap file for the lost packet in the network

15
NETWORKED APPLICATION MANAGEMENT
From the above graph it is identified that the maximum throughput of the network is of around 1200
bytes and it is displayed for a segment of 0 to 1300 byte length. The interval is 100 bytes of for the
segment length .
Network Retransmission Statistics
The network 3 is considered as unstable since there is more number of packet loss and the graph
also shows fluctuation during retransmitting the packets.

16
NETWORKED APPLICATION MANAGEMENT
Part 4
Microsoft Message Analyzer and the wireshart is compared with each other and the comparison is
made based on its ease of access and use, GUI, visualisation of traffic and statistics generation.
Ease of Access and use –

17
NETWORKED APPLICATION MANAGEMENT
Wireshark is an open source software that is freely available to the user and its size is smaller than
Microsoft message Analyzer. It also needs less PC resources for running than the Microsoft Message
analyser. The minimum requirement for running wireshark is 500 mhz processor, 512 mb RAM and
80 mb HDD space. It is compatible with other network application and used by the network
administrator for the management of network.
GUI –
The GUI of Microsoft message analyser is more enhanced and usable than wireshark a detailed step
is needed to be passed for reaching the final step in message analyser while the user can generate or
apply different filter to get the output from the packet. There are certain options that are not
available in wireshark but in message analyser the user can use the option to generate the output.
Visualization of the traffic –
The data traffic flowing in the network can be viewed with the details such as protocols, information,
length, source address, destination address and the sections can be expanded for getting more
details from the network. The traffic is shown in different panes and the user can select a packet and
expand it for getting its details.

18
NETWORKED APPLICATION MANAGEMENT
Statistics generation –
Reports about the network can be generated using Microsoft message analyser and different
network components can be tested. It is used as a technical tool for management of the access of
the resources and eliminate the risk associated with the network. The tool can be used for
generating statistical report and eliminate the vulnerability of different types of network attack.
Conclusion
From the above report it can be concluded that for analysing the performance of the
website and the network wireshark is used. It is an open source tool that is used for identification of
the network vulnerability and generation of statistical report that is used for identification of the
details of source and destination. The vulnerability of the network can be analysed by capturing live
data packet from the network and analysing the different protocols and the IP address used by the
source and the client and the time taken to reach the destination address. The unknown sources can
be identified from the captured packets and the vulnerabilities acting on the network should be
identified. The number of hops acting on the network should be identified for configuring the
network according to the needs. The traffic in the network can be visualized and the access of usage
of the network should be managed and the interface used for the capturing the data packet should
be selected for capturing the data packet from the network. The use of different network to reach
the network helps in generating an average result for identification of packet loss and
retransmissions.

19
NETWORKED APPLICATION MANAGEMENT
Bibliography
[1]. Benton, A., Arora, R. and Dredze, M. Learning multiview embeddings of twitter users.
In Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics
(Volume 2: Short Papers) (Vol. 2, pp. 14-19)., 2016.
[2]. Cuppens, F. WirelessHART NetSIM: A WirelessHART SCADA-Based Wireless Sensor Networks
Simulator. In Security of Industrial Control Systems and Cyber Physical Systems: First
Workshop, CyberICS 2015 and First Workshop, WOS-CPS 2015 Vienna, Austria, September
21–22, 2015 Revised Selected Papers (Vol. 9588, p. 63). Springer., 2016, June.
[3]. Nayak, P. and Sinha, P. Analysis of Random Way Point and Random Walk Mobility Model for
Reactive Routing Protocols for MANET Using NetSim Simulator. In Artificial Intelligence,
Modelling and Simulation (AIMS), 2015 3rd International Conference on (pp. 427-432). IEEE.,
2015 December.
[4]. Peng, J., Li, H., Wang, Y. and Chen, J. A web tool for measuring gene semantic similarities by
combining Gene Ontology and gene co-function networks. In Proceedings of the 6th ACM
Conference on Bioinformatics, Computational Biology and Health Informatics (pp. 678-679).
ACM., 2015 September.
[5]. Saifuddin, K.M., Ahmed, A.S., Reza, K.F., Alam, S.S. and Rahman, S. Performance analysis of
cognitive radio: Netsim viewpoint. In Electrical Information and Communication Technology
(EICT), 2017 3rd International Conference on (pp. 1-6). IEEE., 2017 December.
[6]. Singh, G. and Singh, H. Performance Evaluation of MANET Routing Protocols using
NETSIM. i-Manager's Journal on Information Technology, 6(1), p.8., 2016.
[7]. Singh, G., Cheema, A.K. and Kapoor, N. Performance Evaluation of Routing Protocol in
Internet of Things using Netsim. International Journal, 8(3)., 2017.
[8]. Chappell, L. Wireshark 101: Essential Skills for Network Analysis-Wireshark Solution Series.
Laura Chappell University., 2017.
[9]. Sanders, C. Practical packet analysis: Using Wireshark to solve real-world network problems.
No Starch Press., 2017.
[10]. Ndatinya, V., Xiao, Z., Manepalli, V.R., Meng, K. and Xiao, Y. Network forensics
analysis using Wireshark. International Journal of Security and Networks, 10(2), pp.91-106.,
2015.

20
NETWORKED APPLICATION MANAGEMENT
[11]. Walnycky, D., Baggili, I., Marrington, A., Moore, J. and Breitinger, F. Network and
device forensic analysis of android social-messaging applications. Digital Investigation, 14,
pp.S77-S84., 2015.
[12]. Messier, R. Packet Capture and Analysis. Network Forensics, pp.81-112., 2017.
[13]. Cappers, B.C. and van Wijk, J.J. Semantic Network Traffic Analysis using Deep Packet
Inspection and Visual Analytics., 2017.
[14]. Quadrio, G., Bujari, A., Palazzi, C.E., Ronzani, D., Maggiorini, D. and Ripamonti, L.A.
Network analysis of the steam in-home streaming game system: poster. In Proceedings of
the 22nd Annual International Conference on Mobile Computing and Networking (pp. 475-
476). ACM., 2016, October.