Wireshark Based Network Analysis Report - Traffic Analysis

This report provides a comprehensive analysis of network traffic using Wireshark, focusing on two websites. It covers general statistics, network performance metrics such as throughput and round trip time, load distribution, warnings and errors, and TCP retransmissions. The report compares the perfor...Read More

Network Analysis using
Wireshark
Student ID: MIT172244
1

Contents
Task Description..........................................................................................................................................3
Introduction.................................................................................................................................................4
General Statistics.........................................................................................................................................5
Network Performance.................................................................................................................................7
Comparison 1............................................................................................................................................13
Comparison 2............................................................................................................................................15
Conclusion.................................................................................................................................................17
Reference..................................................................................................................................................18
2

Task Description
This report is prepared for the analysis the two given websites using a network analyzer such as
Wireshark Tool. This task requires to analyze the web traffic of websites and with multimedia content.
For the analysis of a couple of websites has to be chosen from the given list. The site has to be chosen as
per the last digit of the Student ID. Name and the ID are given below.
Name: RAMAN
MIT ID: MIT172244
Website sets are given below according to the ID.
- http://www.radionz.co.nz/news
- https://www.skynews.com.au
3

Introduction
The Internet is the backbone of the today’s high speed computing world. And all the businesses are
transformed to the web application and these applications relies heavily on the network infrastructure
implemented at the data centre. And in order to maintain the performance of the application the 24x7
monitoring of the application and its services are done. This report is prepared for the analysis of the
network traffic from host to the web server. The analysis of the network traffic is done using the sniffing
technology. The sniffing tool is available both in the hardware and the software. For this task, we have
chosen the Wireshark.
The Wireshark is available freely on the internet and it is open sources and supports multiple formats.
Now, this tool provides various capabilities for the system and network administrator to analyze the
given website network traffic and rectify the issues in the network. And this also helps in providing the
report regarding various factor application services. Now report is described in four parts and each part
is given below.
- General statistics of the websites traffic capture.
- Wireshark graph screenshot for various statistics dependent on the traffic.
- Statistics and graph comparison from both website traffic.
- Network Traffic Packet Evaluation with a different tool like Microsoft Message Analyzer.
4

General Statistics
The general statistics are the overall analysis of the network traffic capture which is done using the
sniffing tool like Wireshark. This traffic captured include mostly the textual and multimedia content of
the chosen website. Now one of the websites contains the audio and video content so it uses the
streaming to transfer the website. Now the analysis of the website traffic is done inside the home
network using the Local ISP services. This network uses a very small subnet of class C private address
space i.e. 192.168.1.0/24. And device address is given below.
- Internet Modem – 192.168.1.1
- Traffic Capture Device – 192.168.1.4
Traffic capture statistics analysis of both the website are done one by one and they are given below with
brief details in the table.
Statistics http://www.radionz.co.nz/news https://www.skynews.com.au
Total Time of Packet Capture 143.570 Seconds 185.412 Seconds
Total Number of Packet
Capture
13977 57255
Server IP Address 103.14.3.1 23.76.157.72
Average Packet Size, B 863.5 949.5
Average PPS 97.4 308.8
Average bits/s 672k 2346k
Average bytes/s 84k 293k
The packet capturing was done on the computer workstation which has enough hardware resources for
this task. According to the general statistics of both the website the second website consume more
resources than the first one. This is because of the heavy multimedia content placing on the website
application. All the analysis of the data is done on the Wireshark tool for both the website. And in
general, the heavy pages of the website takes more time to load and requires the high bandwidth
utilization.
Statistics Snapshot
- http://www.radionz.co.nz/news
5

- https://www.skynews.com.au
6

Network Performance
The key part of the application is the performance in all aspect of the user and industry requirement
from loading of the page to data delivery. As the performance has become the critical part of the server
application so it is become very hard to manage all the system resources. So the detailed analysis of the
application need to be done in order to check the application and the hardware are performing
- Throughput
- Round Trip Time
- Load Distribution
- Warning and errors
- TCP retransmissions
Throughput
Throughput is very important for the web server application to work properly on the end machine of the
user. And the throughput analysis helps in understanding the behaviour of the network flow in the
infrastructure of data centre and server. So, for both the website the throughput are:
- Website: http://www.radionz.co.nz/news
7

- Website: https://www.skynews.com.au
Round Trip Time
The Round Trip Time is used to identify the latency in the network traffic and it affects most of the time
for any application on the network. It generally happens due to the poor network connectivity between
host and server [3]. So round trip time for given website are:
- Website: http://www.radionz.co.nz/news
The round trip time of this website is 91ms.
- Website: https://www.skynews.com.au
The round trip time of this website is 10ms.
8

Load Distribution
It is one of a crucial component of the network traffic analysis for the server and web application.
Through this, we can analyze the network traffic priority in the network and can easily identify the issues
for the various website not working properly on the host machine. So, for both the website the load
distribution are:
Website: http://www.radionz.co.nz/news
- Website: https://www.skynews.com.au
9

Warnings and errors
This issue occurs on the day to day basis on every network. And this issue affects most of the application
and its analysis needs to be done regularly. So the graphs of both traffic capture are given below.
- Website: http://www.radionz.co.nz/news
- Website: https://www.skynews.com.au
10

TCP retransmissions
The TCP retransmission graph of both the websites are given below one by one according to the packet
capture analysis in the Wireshark Tool.
- Website : http://www.radionz.co.nz/news
11

- Website : https://www.skynews.com.au
12

Comparison 1
The analysis of the application can only be done with some reference and it cannot be alone analyzed
and predict the result of the performance of the website. There are various factor which affects the
performance of website depending upon the infrastructure of the data center and application. Now, this
part of the report briefly discusses about the comparison between the different website application
which is used to be analyzed.
Now both the website displays the rich multimedia content on their application. And the impact of
performance will be hampered by the number of multimedia data used on each of the websites. One of
the websites mostly uses the textual data which makes the page light and performance of that website
is always high as compared to the heavier page.
Performance for both websites is different as they are used for different functions. So the comparison of
both websites are given below according to the statistical data captured:
- Statistics
The general statistics is the good way to compare the website application performance on the
network and on the user web browser. Now the radionz and skynews websites both shows the
similar statistics but when compare these statistics the amount of the resource utilization taken by
the skynews are high because of the heavy multimedia content in its application. It uses more
network and system resources to process the pages of the website [2].
- TCP Retransmission
The TCP Retransmission is one of the important factors which affects the performance of any
application apart from the HTTP and HTTPS. This mainly happens due to the poor network
infrastructure either from the server side or on the user side. In this scenario, the Skynews as
usually uses high bandwidth to transfer the data from server to user side. The TCP retransmission is
more in this website while the other website has less TCP retransmission due to the less heavy
content on the page.
- Bandwidth Utilization
Now, this is one of the most important factors which affects the performance of any website in the
internet world. Every website requires minimum bandwidth required in order to perform according
to the expectation. Now the skynews website uses the more bandwidth to load the page and the
other sites uses less bandwidth. But due to audio/video content on the skyview website, it utilizes
the network bandwidth continuously due to streaming.
13

- Load Distribution
The network load distribution is high in the skynews because of the bandwidth requirement of the
application to load the page. And it uses a large number of IP packet to transfer the data from
server to the host machine. And also the load of the network resources are overall high due to the
continuous TCP connection for the audio/video content for streaming.
The other website doesn’t use many resources so the distribution of the load demand is very low as
compared to the skynews website.
- Warning and errors
There are various factors due to which the warning and errors come in the network traffic and
according to the captured network traffic of both of the websites. The skynews network traffic, as
usual, has more errors and warnings in the network traffic. The other website doesn’t have that
much issue because of the fewer network resources requirement of the application.
These issues occurred due to various factors on the network like slow network or latency in the
cable. Network related issues in the internet and some internal ISP network issue due to which
most of the time network traffic gets affected.
14

Comparison 2
Traffic analysis is the hectic task for the system and network engineer in order to optimize the network
infrastructure for the services of that application server. So the engineer relies on the various sniffing
and traffic analysis tools which in early phases of development were licensed and require additional
training to learn them. Nowadays there are various tools available for the same work for free just like
the Wireshark network analysis tools. But there are more out on the internet.
The free tool enables the engineer to learn how to use and analyze the network traffic before doing it in
the actual scenario. Wireshark is one of the popular tools which are used by a various network
administrator to tune their network without interrupting the services of that infrastructure. So we need
to discuss the main differences between the various tools available on the internet for this task.
Now here we have chosen the Microsoft Message Analyzer to compare its services and feature with the
popular Wireshark tool. Now the main comparison is given below one by one.
1. Microsoft Message Analyzer tool is the freely available on the Microsoft official website and
anyone can download it [1]. Now, this tools is developed specially or the Microsoft windows so
it doesn’t work on the Linux or other OS out in industries. This tool takes a large time to install
on the system and it is good as compared with the Wireshark. But the Wireshark is popular and
tuned very well because of its community. And also it is open source so anyone can customize it
according to it its need.
2. GUI is one of the important criteria on which we can compare it with the Wireshark. The
Microsoft has provided the enrich User Interface which is very helpful but it is clumsy because
too many options are given on the user window. But the Wireshark has the simple and easy to
understand interface for the user.
3. Now the visualization of the network traffic is one of the key aspects which the non-technical
user can understand very easily. The network traffic analysis is done quite very well in the
Microsoft tool and it has various feature and interfaces for the visualization of the traffic. But
the Wireshark has simple and easy to use interface and require knowledge to use them.
4. Now the generation of the statistics is very easy in the Wireshark and it calculates itself
whenever the capture of the network traffic is done. While in the Microsoft tool the generation
of the statistics takes a lot of time due to the lack of update in the tool from Microsoft. It
generally shows the throughput, RTT, average flow and etc.
15

5. Now the analysis is very simple in the Microsoft tool and it requires a lot of work in the
Wireshark tool to do the detailed analysis according to the requirement of the situation. The
Wireshark shows every detail on the screen when we click packet while in the Microsoft tool it
shows all the information related to that packet and other information which is helpful in the
further analysis of the traffic flow. And also the Microsoft is very complex in its interface [4].
At the end of the day, it turned out that the Wireshark tool is preferred by various analysis and network
administrator because of the open source and freely available on the internet. And also it has support
for the various operating system while the Microsoft is stuck with the Windows-only which cannot
handle large traffic.
16

Conclusion
The Internet connectivity is the backbone of network communication for both the industry as well as for
the general population. Every interaction of the services between the user and the server takes place on
the internet communication. And the traffic utilization goes high if the demand for the services goes up.
So in order in order to keep the services up the tuning of the network traffic is necessary between the
internet and the server.
So the network traffic analyst uses various networking sniffing and analyzing the traffic and optimize it
according to the requirement of that application. Generally the tuning of the application server done
before it goes online. This analysis is necessary in order to keep the services up and no outage happens
during the production hour of the server.
Now, this report is created in order to briefly discuss the performance of the application which is
analyzed inside the data center for any servers. This analysis can also be done on the internet using any
of the computer machines and observe the various parameters of the server application just by looking
at the data collected using the network traffic captured. In turned out the heavier the application
services the data bandwidth will be required more in order for that application to work properly
according to the expectation.
Now in the creation of this report, we also discussed the difference between the Wireshark and the
Microsoft Message Analyzer tool used for the traffic analysis. And thus, it can be concluded that
Wireshark is better than Microsoft Message Analyzer.
17

Reference
[1] T. Lewis, "Microsoft Message Analyzer: The Best Network Troubleshooting Tool You’re NOT
Using", Mirazon, 2016. [Online]. Available: http://www.mirazon.com/microsoft-message-analyzer-best-
network-troubleshooting-tool-youre-not-using/. [Accessed: 29- Jan- 2018].
[2] Linuxtopia, "WireShark - Wireshark User's Guide", Linuxtopia.org, 2017. [Online]. Available:
http://www.linuxtopia.org/online_books/network_security/wireshark_user_guide/index.html.
[Accessed: 29- Jan- 2018].
[3] Concise-Courses, "Wireshark basics 101: A simple concise tutorial for beginners", Concise
Courses, 2017. [Online]. Available: https://www.concise-courses.com/security/wireshark-basics/.
[Accessed: 29- Jan- 2018].
[4] R. Smit, "Microsoft Message Analyzer", Robert Smit MVP Blog, 2017. [Online]. Available:
https://robertsmit.wordpress.com/2013/02/17/microsoft-message-analyzer/. [Accessed: 29- Jan- 2018].
18