Network Capture and Analysis

This report discusses the process of conducting trace routes of two websites and capturing packets using protocol analysers. It compares the network graphs and charts between the home and university networks.

Running head: NETWORK CAPTURE AND ANALYSIS
Network Capture and Analysis
Name of the Student
Name of the University
Author Note

1NETWORK CAPTURE AND ANALYSIS
Summary
The purpose of this report is all about conducting trace routes of two different websites
www.lightfm.com.au and iview.abc.net.au, once from the home network and then from the
university network by the group of students. From one website, multiple images need to be
captured, while from the other various content needs to be streamed followed by a comparison of
the graphs between both the networks are discussed. The report begins by showing the trace routes
and packet capture of the two websites. In this process the websites are traced and the packages
recorded with the help of protocol analysers like Wireshark and MMA or Microsoft Message
Analyser. After conducting the trace routes, the throughput, round trip time and packet loss based
graphs and charts are presented twice with for each website. Once from the university network and
then from the home or workgroup network. After discussing about the differences, difference of
functioning between Microsoft Message Analyser and Wireshark gets explained in detail. Then
conducted the comparison of the two applications the report ends with concluding notes.

2NETWORK CAPTURE AND ANALYSIS
Table of Contents
Introduction...............................................................................................................................3
Part 1..........................................................................................................................................4
Home network...................................................................................................................4
Trace route.........................................................................................................................4
Trace route.........................................................................................................................4
University network.............................................................................................................5
Trace route.........................................................................................................................5
Trace route.........................................................................................................................5
Part 2......................................................................................................................................6
Home network...................................................................................................................6
Trace route.........................................................................................................................6
University Network..........................................................................................................11
Part3.................................................................................................................................17
Microsoft Message Analyser (MMA)...............................................................................21
Conclusion................................................................................................................................22
Bibliography.............................................................................................................................23

3NETWORK CAPTURE AND ANALYSIS
Introduction
This report concerns conducting trace routes of two websites www.lightfm.com.au and
iview.abc.net.au, once from the home network and then from the university network by the group
of students and then a comparison of the graphs between both the networks are discussed. The
report begins by showing the trace routes and packet capture of the two websites. In this process
the websites are traced and the packages recorded with the help of protocol analysers like
Wireshark and MMA or Microsoft Message Analyser [1]. After conducting the trace routes, the
throughput, round trip time and packet loss based graphs and charts are presented twice with for
each website. Once from the university network and then from the home or workgroup network.
After discussing about the differences, difference of functioning between Microsoft Message
Analyser and Wireshark gets explained in detail. Then conducted the comparison of the two
applications the report ends with concluding notes.

4NETWORK CAPTURE AND ANALYSIS
General Statistics
Part 1: Time of Capture number of packets and client server IP
Home network
In this section the group of users are tasked with tracing websites and capturing packets for
loading multiple images as well as streaming content for long durations from the home network. The
websites from which packets have been captured are www.lightfm.com.au and iview.abc.net.au.
The following data have been gathered from the packet capture of the network activity on
the two websites. These are 9 different criteria namely the time of day of commencing packet
capture, number of DNS packets obtained, number of ICMP packets obtained, number of SSL
packets obtained, number of SSDP packets obtained, number of TCP packets obtained, number of
packets that were lost, the IP address of client computer and the IP address of the network server.
Trace route
www.lightfm.com.au
1. Time of capture: 10:36 AM
2. DNS packets: 74
3. ICMP packets: 165
4. SSL packets: 413
5. SSDP packets: 497
6. TCP packets: 3020
7. Lost packets: 0
8. IP address of client: 10.10.30.107
9. IP address of server: 182.156.217.124
Trace route
iview.abc.net.au
1. Time 10:49AM
2. DNS packets: 74
3. ICMP packets: 133
4. SSL packets: 303
5. SSDP packets: 421
6. TCP packets: 2944

5NETWORK CAPTURE AND ANALYSIS
7. Lost packets: 0
8. IP address of client: 10.10.30.107
9. IP address of server: 54.66.253.179
University network
In this section the group of users are tasked with tracing websites and capturing
packets for loading multiple images as well as streaming content for long durations from the
university network. The websites from which packets have been captured are
www.lightfm.com.au and iview.abc.net.au.
The following data have been gathered from the packet capture of the network
activity on the two websites. These are 9 different criteria namely the time of day of
commencing packet capture, number of DNS packets obtained, number of ICMP packets
obtained, number of SSL packets obtained, number of SSDP packets obtained, number of
TCP packets obtained, number of packets that were lost, the IP address of client computer
and the IP address of server computer.
Trace route
www.lightfm.com.au
1. Time 13:00AM
2. DNS packets: 56
3. ICMP packets: 107
4. SSL packets: 132
5. SSDP packets: 214
6. TCP packets: 1128
7. Lost packets: 0
8. IP address of client: 10.10.30.107
9. IP address of server: 182.156.217.124
With the trace route and packet capture of www.lightfm.com.au conducted, the group of students
perform the same for iview.abc.net.au. Here also the analysis has been conducted in the same
process and the criteria of information for analysis of the network activity remains the same [16].
Trace route
iview.abc.net.au

6NETWORK CAPTURE AND ANALYSIS
1. Time 13:24AM
2. DNS packets: 73
3. ICMP packets: 133
4. SSL packets: 303
5. SSDP packets: 421
6. TCP packets: 2944
7. Lost packets: 0
8. IP address of client: 10.10.30.107
9. IP address of server: 54.66.253.179
Network Analysis
Part 2: Screenshots and analysis
Home network
Here the trace routes of the two websites are again performed by the group of
students followed by the subsequent packet capture of the process in wireshark. This
process is conducted on the home or workgroup network of the students.
Trace route
www.lightfm.com.au
A screen capture of the start of the trace route is given below.

7NETWORK CAPTURE AND ANALYSIS
A screen capture of the finish of trace route is given below.
The following is a screenshot of the wireshark packet capture recording for the concerned website.
Packet No. 151, protocol TCP, time 0.474758

8NETWORK CAPTURE AND ANALYSIS
The throughput graph of the packet numbered 151 is given below
1. Throughput

9NETWORK CAPTURE AND ANALYSIS
The round trip time graph of the packet numbered 151 is given below
2. Round Trip Time
A filter for packet losses is applied on the recording of packet capture and number of packet losses
are identified to be 0.
3. Packet Loss

10NETWORK CAPTURE AND ANALYSIS
Trace route
iview.abc.net.au
A screen capture of the start of the trace route is given below.
A screen capture of the finish of trace route is given below.

11NETWORK CAPTURE AND ANALYSIS
The following is a screenshot of the wireshark packet capture recording for the concerned website.
Packet No. 567, protocol TCP, time 1.058328
The throughput graph of the packet numbered 567 is given below
1. Throughput

12NETWORK CAPTURE AND ANALYSIS
The round trip time graph of the packet numbered 567 is given below
2. Roundtrip
A filter for packet losses is applied on the recording of packet capture and number of packet losses
are identified to be 0.
3. Packet loss

13NETWORK CAPTURE AND ANALYSIS
University Network
Trace route
www.lightfm.com.au
A screen capture of the start of the trace route is given below.
A screen capture of the finish of trace route is given below.

14NETWORK CAPTURE AND ANALYSIS
The following is a screenshot of the wireshark packet capture recording for the concerned website.
Packet No. 1028, protocol TCP, time 53.028478
The throughput graph of the packet numbered 1028 is given below
1. Throughput

15NETWORK CAPTURE AND ANALYSIS
The round trip time graph of the packet numbered 1028 is given below
2. Round Trip Time
A filter for packet losses is applied on the recording of packet capture and number of packet losses
are identified to be 0.
3. Packet Loss

16NETWORK CAPTURE AND ANALYSIS
Trace route
iview.abc.net.au
A screen capture of the start of the trace route is given below.
A screen capture of the finish of trace route is given below.

17NETWORK CAPTURE AND ANALYSIS
The following is a screenshot of the wireshark packet capture recording for the concerned website.
Packet No. 1927, protocol TCP, time 111.962070
The throughput graph of the packet numbered 1927 is given below
1. Throughput:

18NETWORK CAPTURE AND ANALYSIS
The roundtrip time graph of the packet numbered 1927 is given below
2. Roundtrip time:
A filter for packet losses is applied on the recording of packet capture and number of packet losses
are identified to be 0.
3. Packet loss

19NETWORK CAPTURE AND ANALYSIS
Part3: Comparison of packet capture and visualization network traffic
The group of students are accessing the websites http://www.lightfm.com.au and
http:// iview.abc.net.au, once from the university campus and then from their home network.
Comparing throughputs in home network and university network for accessing website
www.lightfm.com.au which involves capturing images and other media.
Access from home
Since they are using the same devices the device IP addresses remain the same [11]. The source IP
addresses vary depending on the website they try to access. The segment length may go as high as
1500 with 600000 bits per second. However, most of the segment lengths have very fewer lengths.
Access from University

20NETWORK CAPTURE AND ANALYSIS
Here, a big difference can be seen between that of home network compared to that
of university. Here the segment lengths of the packet remain constant at about 12 with 175
bits per second.
Comparing throughputs in home network and university network for accessing website
iview.abc.net.au which involves live streaming.

21NETWORK CAPTURE AND ANALYSIS
It is found that for the website iview.abc.net.au, both throughputs from the university and
home networks are found to be similar.
Comparison of packet statistics and between Wireshark and MMA and
differences been the tools.
Microsoft Message Analyser (MMA)
Microsoft Message Analyser or (MMA) is the Microsoft’s equivalent protocol analyser.
The below diagram records the trace route of the news web site http:// iview.abc.net.au is caputred
through microsoft message analyser:

22NETWORK CAPTURE AND ANALYSIS
The software application Microsoft Message Analyser MMA provides a very easy to use GUI
application when compared to Wireshark [4] but at the expense of missing out on descriptions and
several features. Moreover, the MMA appears to be bulkier and performs a tad slower than
Wireshark.
Differences between MMA and wireshark are:
1. The record, pause and stop buttons is MMA are easier to figure out.
2. The menubar in Wireshark comes stuffed with buttons for a range of features which make
the experience a bit unforgiving for the beginners.
3. The menu bar in MMA consists of simpler easy to understand buttons for the primary
features that the application offers.
4. Dedicated icons are available in MMA to detect errors in the communication if any.

23NETWORK CAPTURE AND ANALYSIS
The visualization of the traffic is of the above recording can be brilliantly represented through
the TCP diagnostics visualization like in the following diagram [2].
In Microsoft Message Analyser, multiple packets can be selected and their graphs get generated in
the side panel which can be compared and studied at the same time. In another panel the source,
destination and other relevant details are also given. In addition to all this multiple packets can also
be selected by using ctrl + mouse click on packets from bottom panel.
Conclusion
In conclusion this report succeeds in conducting trace routes of two websites
www.lightfm.com.au and iview.abc.net.au, once from the home network and then from the
university network by the group of students and then a comparison of the graphs between both the
networks are discussed. The report begins by showing the trace routes and packet capture of the
two websites. In this process the websites are traced and the packages recorded with the help of
protocol analysers like Wireshark and MMA or Microsoft Message Analyser. After conducting the
trace routes, the throughput, round trip time and packet loss based graphs and charts are presented
twice with for each website. Once from the university network and then from the home or
workgroup network. After discussing about the differences, difference of functioning between
Microsoft Message Analyser and Wireshark gets explained in detail following which the report ends.

24NETWORK CAPTURE AND ANALYSIS
Bibliography
[1] A.J. Charles, and P. Kalavathi, QoS Measurement of RPL using Cooja Simulator and Wireshark
Network Analyser. , 2018.
[2] C. Jandaeng, October. Comparison of RDBMS and document oriented database in audit log
analysis. In 2015 7th International Conference on Information Technology and Electrical Engineering
(ICITEE) (pp. 332-336). IEEE. , 2015,
[3] I. Burke, and R.P. van Heerden, Treating personal data like digital pollution. In ECCWS 2017 16th
European Conference on Cyber Warfare and Security (p. 82). Academic Conferences and publishing
limited. , 2017, June.
[4] K. Deokule, P. Modi, D.Mistry, H. Patki, A. Patel, and O. Abuzaghleh, Network Traffic
Measurement and Analysis., 2016.
[5] L. Csikor, and D.P. Pezaros, December. End-Host Driven Troubleshooting Architecture for
Software-Defined Networking. In GLOBECOM 2017-2017 IEEE Global Communications
Conference (pp. 1-7). IEEE. , 2017,
[6] L. Yuan, Research and Design on CAN Network Analyser based on USB Interface. In 2015
International Power, Electronics and Materials Engineering Conference. Atlantis Press. , 2015, May.
[7] M. Candela, M. Di Bartolomeo, G. Di Battista, and C. Squarcella, Radian: visual exploration of
traceroutes. IEEE transactions on visualization and computer graphics, 24(7), pp.2194-2208. , 2017.
[8] M. Marchetti, F. Pierazzi, M. Colajanni, and A. Guido, Analysis of high volumes of network traffic
for advanced persistent threat detection. Computer Networks, 109, pp.127-141., 2016.
[9] M. Rodrigues, and O. Shobayo, Design and Implementation of a Low-Cost Low Interaction IDS/IPS
System Using Virtual Honeypot Approach. Covenant Journal of Informatics & Communication
Technology, 5(1), pp.48-64. , 2017.
[10] P. Eden, C. Pontypridd, A. Blyth, P. Burnap, Y. Cherdantseva, K. Jones, H. Soulsby, Q.H.C. Springs,
and K. Stoddart, Forensic Readiness for SCADA/ICS Incident. In Proceedings of the 4th International
Symposium for ICS & SCADA Cyber Security Research (p. 142). , 2016.
[11] P. Marchetta, V. Persico, G. Aceto, A. Botta, and A. Pescape, Measuring Networks Using IP
Options. IEEE Network, 31(3), pp.30-36., 2017.