Wireshark Live Capture of Websites

Answer Packet capture To successfully have a live capture a live capture of as specified website after installation of Wireshark one need to have to open the browser and clear the cache. If he has promiscuous mode activated, it is activated by default and he/she will as well experience each of the other packets on the system instead of packets that are only addressed to the net adapter. Then open the URL and for this case we stop the traffic by pressing the “Stop” button that is red

Running header: WIRESHARK 1
Wireshark
Student’s Name
Institution
Date

WIRESHARK 2
Network Security Analysis
Question 1.
Explain how you performed the packet capture and deciphered the data.
Answer
Packet capture
To successfully have a live capture a live capture of as specified website after installation
of Wireshark one need to have to open the browser and clear the cache. Secondly, open the
wireshark . One can organize advanced structures by pressing Capture > Options.

WIRESHARK 3
Immediately after one clicks the interface’s label, the packets will start appearing.
Wireshark captures all packets sent from or to the systems. If he has promiscuous mode
activated, it is activated by default and he/she will as well experience each of the other packets
on the system instead of packets that are only addressed to the net adapter. To check whether the
promiscuous approach is activated, click Capture > Options as well as confirm the "activate
wanton mode on each interface" checkbox is initiated at the base of the window 1. Then open the
URL and for this case the https://www.4-realestateagent.com/
1 Sahin, Ozcelik, Balta, & Iskefiyeli, 2013

WIRESHARK 4
After this we stop the traffic by pressing the “Stop” button that is red, found near the left corner
of the window at the top or by pressing both the Ctrl + E2.
Data decipher
Dissecting a whole packet will typically comprise a number of dissectors because each
procedure has its specific dissector 3. As Wireshark attempts to get the ideal dissector for every
2 Banerjee, Vashishtha, & Saxena, 2010
3 Sanders, 2017

WIRESHARK 5
packet (by use of heuristics “guessing” and static “routes”), it might pick wrong dissectors in
specific cases. The Enabled Procedures dialog boxes let one disable or enable specific
procedures. All procedures are activated by default. If a protocol is inactivated, Wireshark stops
to process a packet each time that procedure comes across.
To disable or enable protocols choose to Analyze → Enabled Procedures…. Wireshark will
bring the “Enabled Protocol” dialog boxes as illustrated in Diagram 10.4, i.e.: “The “Enabled
Protocol” dialog box”4.
To enable or disable a procedure, one should just click it by use of the mouse or by
pressing the space bar whenever the procedure is selected5. It is important to note that, by typing
the initial letters of any protocol title when the Enabled Protocol dialog chamber is enabled will
briefly open search text boxes and automatically choose the initial matching procedure name
(when it exists). To save one's settings it is necessary to click the Save key. The Apply or
OK button will not save the changes eternally and the changes will be missing after closing the
Wireshark.
One can select from the following activities:
The "Decode As" usefulness lets one incidentally redirect particular convention analyzations.
This can be helpful for instance, on the off chance that you do some unprecedented tests on your
system (Wang, Xu, & Yan, 2010). Decode As is gotten to by choosing the Analyze → Decode
4 Sanders, 2017
5 Chappell & Combs, 2010

WIRESHARK 6
As…. Wireshark will appear the "Decode As" chat box as demonstrated in Figure 10.5, i.e. “The
"Decoding As" chat box".
The features of this chat box rely upon the packet selected when it was opened. The
settings will be misplaced when one quit Wireshark or if one changes profile unless he/she save
the access key in the SUSD (Show User Specified Decode). The chat box demonstrates the
currently active User indicated decodes6. The entry key might be kept into the current profile for
the future session.
6 Lamping, Sharpe & Warnicke, 2014

WIRESHARK 7
Question 2
Explain the communication-taking place between your machine and the web server.
Answer:
Several links between the webserver and machine occur at Transmission Control
Protocols/Internet Protocols (TCP/IP) pile. Hyper Text Transfer Protocol (HTTP), applied for
transporting website pages7. TCP/IP stack is made up of four layers which are: Network,
Internet, Transport, and Application. There are diverse protocols that are utilized to regulate the
movement of data at each layer, and all are computer programs (running on the PC) that are
applied to arrange the data into a packet when moving down the Transmission Control
Protocol/Internet Protocol stacks. Packets are made by a combination of the TCP or UDP
7 Pöttner & Wolf, 2010

WIRESHARK 8
(Transport Layer title), the Application Layer information, as well as the IP layer title (the Layer
take the packets and then turn it into frames)
The Transport Layer is in charge of relegating source as well as goal port numbers to
applications. The Transport Layer for tending to use port numbers where they run from 1 to
65,535. Port numbers from 0 to 1023 are known as "well-known ports8. The port numbers
underneath 256 are saved for open (standard) benefits that keep running at the Application
Layer. Here are two or three: 80 for HTTP, 53 for DNS (UDP for area determination and TCP
for zone exchanges), and 25 for SMTP. Ports numbering from 1024 to 65,535 are utilized for
customer-side applications - the website program being used by the machine to peruse this page.
The Application Layer comprises of all applications that utilize the system to transport
information. Applications transfer information to the subsequent layer in the TCP/IP stack and
after that keep on performing different capacities until the point when an answer is gotten. The
Application Layer utilizes host terms (such as www.dalantech.com) for tending to. Cases of
application layer conventions: SMTP - electronic mail, HTTP - web perusing, DNS - settling
hostnames to the IP addresses9. The primary reason for the Application Layer is to give a request
as well as language structure among applications which, are running on various operating
frameworks - like a translator. The information that is sent by an application that uses the system
is designed to fit in with one of a few set principles. The accepting PC can comprehend the
information that is being sent regardless of whether it is running an unexpected operating
8 "Gupta & Mamtora, 2012
9 Ndatinya, Xiao, Manepalli, Meng, & Xiao, 2015

WIRESHARK 9
framework in comparison to the sender because of the measures that all system applications
adjust to.
The Internet Layer acts like the "adhesive" that clamps networking together where it allows the
transfer, receiving, as well as routing of information.
The Network Layer comprises of one’s NIC (Network Interface Card) as well as the cable linked
to it. Data is transmitted and received by the physical medium. The Network Layer utilizes MAC
(Media Access Control) addresses, talked about prior, for an address10. The Media Access
Control address is settled at the time an interface was made and cannot be altered. There are a
couple of special cases, such as DSL switches that enable ones to clone the Media Access
Control address of the Network Interface Card in the computer.
Question 3
Write a report on the technology used to implement this https site giving an overview of
how it works history of the technology & advantages/disadvantages of the security methods
adopted.
Solution
Being extensively utilized on the HTTPS (Hypertext transfer protocol secure) or HTTP
(internet hypertext transfer protocol) is an allowance for safe communications over a PC
network. The communication protocol is encoded by TLS (Transport Layer Security) in the
10 Ndatinya, Xiao, Manepalli, Meng, & Xiao, 2015

WIRESHARK 10
Hypertext transfer protocol secure or its precursor SSL (Secure Sockets Layer).This protocol can
likewise be denoted to a HTTP over SSL, or HTTP over TLS. It is the administrator obligation to
generate a public key license for the website server to make a website server receive HTTPS
links11. For a web browser to consent to it deprived of warning the certificate must be signed by a
dependable certificate authority.
Consequently, the protocol is as well often known as hypertext transfer protocol over
SSL or hypertext transfer protocol over TLS. To make website servers to take HTTPS links, the
administrator should generate public key certificates for the website servers. This license should
be approved by a trusted licensing body for the website browser to take it without any warning.
The certificate owner is certified by the authority as the regulator of the website server that
grants it. In the year 1994 Netscape Communication produced HTTPS aimed at its Netscape
Navigator website browser 12. HTTPS was formerly utilized with SSL procedure13. HTTPS was
officially detailed by a tool known as RFC 2818 in the year 2000 as SSL advancd into TLS
(Transport Layer Security).HTTPS connections historically were mainly utilized for
disbursement dealings on the email, World and for delicate transactions in corporate information
systems
Originally, hypertext transfer protocol links were basically utilized for installment
exchanges on the email, World Wide Website and for delicate businesses in corporate data
11 Pöttner & Wolf, 2010
12 Pöttner & Wolf, 2010)
13 Lamping, Sharpe & Warnicke, 2014

WIRESHARK 11
frameworks14. Since 2018, hypertext transfer protocol (HTTPS) is utilized more frequently by
website users than the first non-secure hypertext transfer protocol, essentially to ensure page
credibility on a wider range of sites; secure records; and keeping client communication,
personality, as well as website perusing private.
Benefits of HTTPS
o Data Honesty: When information is sent free, it is feasible for an outsider to get in
between the browser and the server and access everything, however, much more terrible,
when they access it, they may transform it.
o Identity Confirmation: A certificate ensures the data a program is getting begins in the
normal space. It is a certification that when a client sends delicate information, it's being
sent to the intended place, and not to a malevolent outsider
o SEO: Google desires to transfer its clients to safe sites hence making HTTPS links a rank
signal.
o Trust: Lastly, the green padlock shows that when one takes safety seriously, it helps to
give clients assurance.
Disadvantage
o HTTPS may reduce the AdSense earning
o HTTPS might affect the Google PageRank
o BlogSpot Images possess absolute routes and are not relative
14 Lamping, Sharpe & Warnicke, 2014

WIRESHARK 12
o HTTPS is never 301 transmitted to https
o HTTPS might make widgets to stop functioning on one’s blog
Question 4
The both the 4-realestateagent.com and https://paypal.com use different protocol which
are captured differently. Following the initial instruction of question to capture question 1to
capture for https://paypal.com When observing the traffic captured in the Wireshark top packetl list
sheet. To see just HTTPS activity, type ssl (bring down case) in the Filter box and press Enter. Select
the primary TLS bundle named Client Hello. This will help observe the IP address. To see all related
movement for this association, change the channel to ip.addr == <destination>, where <destination>
is the goal address of the HTTP bundle. When observing the traffic in the https://paypal.com. The
initial three parcels ( TCP SYN/ACK, TCP SYN,TCP ACK) are the TCP three-way handshake.
Choose the first packet. Observe the bundle subtle elements in the center Wireshark parcel points of
interest sheet. Notice that it is an Ethernet II/Internet Protocol Version 4/Transmission Control
Protocol outline. Grow Ethernet II to see Ethernet points of interest. Observe the Destination and
Source fields. The goal ought to be your default entryway's MAC address and the source ought to be
your MAC address. You can utilize ipconfig/all and arp - a to affirm. Extend Internet Protocol
Version 4 to see IP subtle elements. Observe the Source address. Notice that the source address is
your IP address. Observe the Destination address. Notice that the goal address is the IP address of
the HTTPS server. Extend Transmission Control Protocol to see TCP subtle elements. Observe the
Source port. Notice that it is a dynamic port chose for this HTTPS association. Observe the
Destination port. Notice that it is https (443). Note that the majority of the parcels for this association
will have coordinating MAC addresses, IP locations, and port numbers.

WIRESHARK 13
4-realestateagent.com utilizes the hypertext transfer protocol reaction header (Wang, Xu,
& Yan, 2010). A HTTP reaction header principally empowers imparting and reacting to client
demands got on a Web server or the site. A HTTP reaction header works when a site page or
hypertext transfer protocol application is created from the customer's Website program. This
demand is gotten as a HTTP request header to the Web server containing the source address,
asked for information and its arrangement and other information. The Web server reacts back by
making a hypertext transfer protocol reaction header and joining the required information with it.
The data implanted with the HTTP reaction header incorporates the goal IP address, type of
information, host addresses, etc.
References

WIRESHARK 14
Banerjee, Usha, Ashutosh Vashishtha, and Mukul Saxena. "Evaluation of the Capabilities of
WireShark as a tool for Intrusion Detection." International Journal of computer applications 6,
no. 7 (2010).
Chappell, Laura. Wireshark 101: Essential Skills for Network Analysis-Wireshark Solution
Series. Laura Chappell University, 2017.
Gupta, Shilpi, and Roopal Mamtora. "Intrusion detection system using wireshark." International
Journal of Advanced Research in Computer Science and Software Engineering (IJARCSSE) 2,
no. 11 (2012).
Luo, Qing-Lin, Ke-Fu Xu, Wen-Yi Zang, and Jin-Gang Liu. "Network protocol parser and
verification method based on Wireshark." Computer Engineering and Design 32, no. 3 (2011):
770-773.
Ndatinya, Vivens, Zhifeng Xiao, Vasudeva Rao Manepalli, Ke Meng, and Yang Xiao. "Network
forensics analysis using Wireshark." International Journal of Security and Networks 10, no. 2
(2015): 91-106.
Pöttner, Wolf-Bastian, and Lars Wolf. "IEEE 802.15. 4 packet analysis with Wireshark and off-
the-shelf hardware." In 7th International Conference on Networked Sensing Sytems (INSS’10).
2010.
Sahin, Veysel Harun, Ibrahim Ozcelik, Musa Balta, and Murat Iskefiyeli. "Topology discovery
of PROFINET networks using Wireshark." In Electronics, Computer and Computation
(ICECCO), 2013 International Conference on, pp. 88-91. IEEE, 2013.
Sanders, Chris. Practical packet analysis: Using Wireshark to solve real-world network
problems. No Starch Press, 2017.