Detailed Report: Wireshark Analysis of Network Application

This report provides a detailed analysis of network application traffic using Wireshark, a network packet analyzer. The analysis involves capturing network packets on both Linux and Windows platforms, examining the captured data, and analyzing network protocols such as TCP and HTTP. The report includes an overview of Wireshark, the data capture process, and the identification of IP addresses and MAC addresses. It discusses the TCP three-way handshake, DNS queries, and round trip delay. The report also compares Wireshark with Microsoft Message Analyzer, highlighting their strengths and weaknesses in network analysis. The analysis aims to provide insights into network behavior, protocol usage, and potential network issues. The document also touches on network components such as PCs, interface cards, ethernet cables, modems, firewalls, routers, and switches.

NETWORK APPLICATION
Network Application
Student Name
Institution
Date
1

NETWORK APPLICATION
OVERVIEW
It is a not built up source that checks network packets at stage that takes in and make analysis
of the traffics made on the net in two platforms, Linux plus Windows. Graphical User Interface
and Command Line in windows Operating System that possess version of the packet thus
giving an inclusive breakdown of the net code of behavior for every packet captured that adds
color to the specifics of packets based on net protocol adding to possessive functionality for
filtering and observing traffic flow filter that recognizes Transmission control Protocol (Mishra,
2006)
OVERALL DATA
The goal of the scheme is take in information from 2 webs using Wireshark. Data capturing is
carried out at home of the net where connections are via Interface of the Ethernet. In this
analysis carried out in the laboratory, Wireshark is used to mainly for capturing and examining
packets that would be produced amongst different webs that would have been given out
together with the Personal Computer browsers that uses HyperText Transfer Protocol and
Server of the website after analysis are made on the packets and error network. The
presentation made on the net is analyzed using info produced (Tarasov and Malakhov, 2015).
Introduction of Wireshark in the system regulates output, operational load, scalation of windows
and time sequence presentation by the use of produced packets.
2

NETWORK APPLICATION
Capture period
After the Wireshark was opened, the monitor appearance looked just as shown in the diagram
below:
3

NETWORK APPLICATION
The client internet protocol and sequence of numbers are recognized. When HyperText
Transfer Protocol is launched on the website that hosts the server, TCP uses a 3-way process
to establish TCP session that is depended upon amongst 2 hosts. For example, even though
making access to the above sites via net makes an initiation of a 3-way process after a session
amid the Personal Computer host and a web server are recognized. A host PC could have a
changed concurrent lively TCP session by means of numerous websites. Ten minutes is the
time the packet was captured thus the sum of packets being five thousand one hundred and
twenty-three packets obtained (Shepherd, 1999).
4

NETWORK APPLICATION
Sum of Capture packets
The internet protocol and Media Access Control addresses would be used to capture
Packets:
The IO address for the host PC is 10.1.14.61
The MAC address for the PC host is:00.23.24.5A.ED.8D
The IP address for the DNS server queried by the computer was 192.168.111 while the IP
address for the Google web server was: 192.168.1.130.
5

NETWORK APPLICATION
IP address of client and server
The percentage of packets captured in Transfer Control Protocol given an instance of higher
level protocol that uses Transfer Control Protocol (ZHANG and CHEN, 2009)
Output
The 1st setting provides each packet a number that can be tracked. During the analysis
of the web, a few points were jotted down for effective study. They are as follows:
 Time the packet was received
 The origination and destination of internet protocol annals
 The type of protocol the packet used, Transfer Control Protocol, Hypertext Transfer
Protocol and User Diagram Protocol
 Determination length of the protocol size
 Detailed information on whether the packet is app info
6

NETWORK APPLICATION
Domain Name System query from the computer to the Domain Name System server is shown
by frame 11. It tries to resolve the website domain to the web serve’s IP address.
Round Trip Delay (RTD)
The Internet protocol address of the Domain Name System server enquired by the Personal
computer for the website (http:// iview.abc.net.au) is 10.1.50.230. It makes it probable for
Personal Computer to carry the packet to the web server. The start of Transfer Control Protocol
handshake amongst web server Google and the Personal Computer is on frame thirteen.
7

NETWORK APPLICATION
8

NETWORK APPLICATION
The grouping quantities of the initial six sections in the Transfer Control Protocol
association
The Transfer Control Protocol source port numbered 49323 and the number to be destined
being 433 means that a dynamic port source and know destination port. Protecting useful info
from the public would become easier incase all the info was placed in central information source
in a single PC. An individual would be familiarized with what to hide, what to hand out, the
location of everything make protection of it. Dave Cullen from Computingforever.com made a
poll and initiated that there are at least 3 PCs in each home which are connected all at once by
net. Local Area Network and Wireless Local Area Network are most likely type of network that
could be used in these homes. LAN is a wired connection in a building where as wireless
connections need no wires. Or maybe the two combinations can be made at the same time
where an ethernet cable is connected to a router while other PCs connects to the signal
transmitted wirelessly. There are several types of networks, Wide Area Network (WAN). It
covers a wide distance over a geographical location, the City Sized Metro Area Network (MAN)
together with the Campus Area Network (CAN). No matter the type and size of the electronic
network, they have similar basic parts that make it a pillar of the network CIS, 2008). The
following are 5 crucial components that constitute a network. They include: Personal Computers
and the Interface Cards, Ethernet Cables, modems, firewall and the routers or switches.
9

NETWORK APPLICATION
Personal Computers connect to the net via a wired or wired platform. Both procedures need to
go via the network Interface Card for data transmission from the Pc. There is a one place where
info is stored that is so private. Occasionally, PCs have programs that are always installed in
them to make sure that the data stored remains private. PCs that connected by use of cables
via a router have a standardized networking of cat5e cable. It is a twisted pair cable. Coaxial
cable is another type of the cable that used mainly for running larger areas together with the
fibred optic cable that is purposefully for a wide geographic location e.g. over seas. Digital
signal is converted into analog and analog signals are converted to digital signal by the modem
in to make data packets travel lengthwise from the phonelines plus out of the net. Separation of
the network from network components are done by the Firewall. Hub and switch are component
pieces that try to put almost everything connected via net. They control and allow data
transmission through the net. These two components operate differently but the hub is simplest
compared to other three.
http://www.news.com.au
Transfer Control Protocol Re-transmissions
The Internet Protocol address for the Host PC IS 192.168.1.130
MAC ADDRESS IS C8-Oa-a9-fa-de-od
10

NETWORK APPLICATION
Frame 13 there is the DNS resolution and frame 17 shows the response from after the full DNS
resolution.
11

NETWORK APPLICATION
The start of three-way handshake among the Google web server and the PC is on frame 15
The IP address of the DNS server queried by the computer for the website (http://
iview.abc.net.au) is 10.1.50.230. This makes it possible for the PC to convey the packet to the
web server.
Re-transmitted segments in the document
12

NETWORK APPLICATION
Transfer Control Protocol source port number was: 49523 which implies that it is an irregular
source port and the goal port number were 80 meaning it is a http goal port. For this
investigation there are no banners sets however the relative recurrence is set to zero.
COMPARISON 1: Correlation of the throughput and TCP retransmission of the two Applications
on the three systems
In the beginning, it appeared that the Transfer Control Protocol is fine because of the networks
positioning. Nonetheless, the data transmitted and way It was responded in the Transfer Control
Protocol that brings real-time stream of voice via a net connection. Transfer of files generally
need to be depended upon for transmission thus Transfer Control Protocol is the one that is
ideal. On Remote Login, Transfer Control Protocol is preferred since it offers reliable stream
stroke transfers that make up a basic application for remote login. Multicast communication is
another component that relays info to a subset of destined networks that are attached. It
becomes so easy to figure out how multicast apps need dependable transmission of info
streams to several end points plus the multicast apps that need best determination for
transmission of the private SMS. Thus, Transfer Control Protocol and User Diagram Protocol is
never preferred. Which adds another relevant point that, providing dependable multicast stream
13

NETWORK APPLICATION
transfer service is problematic during implementation and Transfer Control Protocol is never
meant for it.
The figure above delineates the association start process among the web server and the
customer. After the foundation of the association information outlines start to stream. The vital
frame points of interest are appeared in the chart stream i.e. via transmission time, outline
measure, succession number of the frame and the Transfer Control Protocol ports.
Throughout graph
14

NETWORK APPLICATION
The bottommost of the diagram displays a starting tine and the finish time. The start time is
comparative to the start of the process that is initially zero.
That moment the packets begin to wrap out, it becomes the comparative time balance of the 1st
packet available. The finishing is constantly the total time taken in every session.
Cutoffs are shown by a straight up line. A green view shows the range of time that corresponds
to the observable slots in the timeline. The view port anytime can be placed anywhere by
making a click anywhere in the graphical presentation. Anytime it is moved, the timelines scrolls
to match. That moment when the slot range in the timeline make variations, view port moves
and changes in size that becomes important in matching.
COMPARSION 2: Comparison of the picked too with Wireshark regarding straightforward entry
and utilize, GUI, perception of activity and measurement age.
.
Analyzer are fundamentally the same as in the reality they both catch and show live movement
over a system utilizing a wide range of channels to enable a director to see precisely the activity
he or she needs to see without watching every one of the information all the while
.
15

NETWORK APPLICATION
Microsoft message examiner live Trace Process conformation
16

NETWORK APPLICATION
Be that as it may, the Message Analyzer can peruse for logs of various sorts, and import
them together, and in addition the capacity to naturally re-gather and render payloads. The most
noteworthy remarkable component I found in the Message Analyzer was the capacity to import
and examine information from log and follow records in various watcher positions. As much as I
prefer not to state it, I would figure the Message Analyzer would be the decision for organize
catch and investigation in the work environment in light of the fact that these novel highlights
would spare a ton of time when attempting to analyze a system issue. Wireshark requires a ton
of manual examination that what is essential by the Microsoft message.
INFERENCE
Taking everything into account, being an open-source apparatus, Wireshark as a package
examiner is utilized as a part of investigating and investigating systems and correspondence
protocols. It empowers the clients to observe the interface of a system and put controllers which
can go down the unbridled mode. To have the capacity to watch and screen the obvious traffics
unmistakable on the specific interface and not just activity that is routed to one of the interface
with the address that has been arranged to communicate and address the system movement.
Amid catching in the unbridled mode with the bundle analyzer, not the majority of the movement
that movements over the switch are naturally sent to the port where the catch occurring. This is
the reason, catching in the unbridled mode was not adequate for the live site in watching all the
activity on the system. In spite of the fact that Wireshark is the chief system analyzer instrument
on the planet and it the standard utilized apparatus crosswise over the vast majority of the
organizations. I trust Message Examiner would be the decision for arrange catch and
examination in the working environment in light of the fact that these one of a kind highlights
would spare a ton of time when endeavoring to analyze a system issue. Wireshark requires a
considerable measure of manual examination that what is essential by the Microsoft
communication
.
17

NETWORK APPLICATION
References
1. Mishra, U. (2006). 10 Inventions on Command Buttons in a Graphical User Interface.
SSRN Electronic Journal.
2. Zhanikeev, M. (2014). A lockfree shared memory design for high-throughput multicore
packet traffic capture. International Journal of Network Management, 24(4), pp.304-317.
3. Tarasov, V. and Malakhov, S. (2015). Statistical data handling program of Wireshark
analyzer and incoming traffic research. Proceedings of the Institute for System
Programming of the RAS, (3), pp.303-314.
4. Shepherd, B. (1999). Establishing radiologic image transmission via a transmission
control protocol/internet protocol network between two teaching hospitals in Houston.
Journal of Digital Imaging, 12(S1), pp.88-90.
5. ZHANG, D. and CHEN, L. (2009). Improved method of TCP-friendly congestion control
protocol. Journal of Computer Applications, 29(3), pp.672-674.
6. Pforte, L. (2016). Extensions of simple modules for SL3(2f) and SU3(2f).
Communications in Algebra, 45(10), pp.4210-4221.
18