Wireshark: first capture¶

Exercise wireshark-first-capture-annex.pdf · PDF

So far, tcpdump gave you one dense line per frame. You trusted that the envelopes were there. What if you could open one frame on screen, like a letter on a table, and point at each envelope with the mouse?

That is what network technicians do every day when "it does not work" and nobody knows why. The tool is free, it runs on your PC, and by the end of this page you will have read a ping layer by layer in it.

What is a packet analyser?¶

A packet analyser (or sniffer) copies every frame that passes through a network card and decodes it, layer by layer.

tcpdump is one, in text. Wireshark is the graphical one that every network professional uses. It is free software. Gerald Combs started it in 1998 under the name Ethereal; it has been called Wireshark since 2006.

In the postal analogy, Wireshark is a photocopier at your own letterbox: it copies every envelope that arrives at or leaves your door, and lays the copies open on the table, outer envelope first.

The three panes¶

Wireshark's window has a filter bar and three panes, from top to bottom:

flowchart TB
    subgraph WS ["Wireshark window"]
        direction TB
        F["<b>Filter bar</b><br>which frames to show"]
        L["<b>Packet list</b><br>one line per frame"]
        D["<b>Packet details</b><br>one line per layer:<br>the envelopes, opened"]
        B["<b>Packet bytes</b><br>the raw hex"]
        F --> L -->|"click a frame"| D -->|"click a field"| B
    end

The details pane shows the envelopes in the order they are opened: first Frame (Wireshark's own summary: size, time), then Ethernet II (the outer envelope), then Internet Protocol Version 4 (the middle envelope), then the letter. It is the envelope relay from How a message travels, on screen.

Lab: a ping, layer by layer¶

Capture into a file¶

A pcap file (packet capture) stores captured frames so you can open them later. You capture inside the lab with tcpdump -w, then open the file on the Ubuntu host. Three terminals: pc1, pc2, and one on the host.

G=3 containerlab deploy -t lan.clab.yml               # host
tcpdump -c 6 -i eth1 -w /tmp/ping.pcap arp or icmp    # pc2: saves 6 frames
ping -c 2 10.G.0.12                                   # pc1
docker cp clab-lan-pc2:/tmp/ping.pcap .               # host: copy it out of pc2
wireshark ping.pcap &                                 # host

tcpdump stops by itself and says 6 packets captured. docker cp copies a file out of a container. It is a host command: do not type it inside pc2.

The packet list¶

For group 1 the list looks like this (your MAC addresses differ):

1  0.000000  46:62:c0:ea:cd:fc → Broadcast          ARP   42  Who has 10.1.0.12? Tell 10.1.0.11
2  0.000015  1a:0d:d5:0a:2b:81 → 46:62:c0:ea:cd:fc  ARP   42  10.1.0.12 is at 1a:0d:d5:0a:2b:81
3  0.000021  10.1.0.11 → 10.1.0.12                  ICMP  98  Echo (ping) request  id=0x0159, seq=1/256, ttl=64
4  0.000029  10.1.0.12 → 10.1.0.11                  ICMP  98  Echo (ping) reply    id=0x0159, seq=1/256, ttl=64
5  1.042338  10.1.0.11 → 10.1.0.12                  ICMP  98  Echo (ping) request  id=0x0159, seq=2/512, ttl=64
6  1.042353  10.1.0.12 → 10.1.0.11                  ICMP  98  Echo (ping) reply    id=0x0159, seq=2/512, ttl=64

Six frames: the ARP question and answer you met in Ethernet, MAC addresses and switching, then two pings. Notice the Source column: a MAC for ARP, an IP for ICMP. Wireshark shows the address of the highest layer it finds, and an ARP frame has no IP header.

Frame 3, opened¶

Click frame 3 and open each line with its arrow:

Frame 3: 98 bytes on wire (784 bits), 98 bytes captured (784 bits)
Ethernet II, Src: 46:62:c0:ea:cd:fc, Dst: 1a:0d:d5:0a:2b:81
    Destination: 1a:0d:d5:0a:2b:81      Source: 46:62:c0:ea:cd:fc      Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 10.1.0.11, Dst: 10.1.0.12
    Header Length: 20 bytes (5)   Total Length: 84   Time to Live: 64   Protocol: ICMP (1)
Internet Control Message Protocol
    Type: 8 (Echo (ping) request)       Code: 0       Data (40 bytes)

The key idea: each layer has one field that names the next layer. That is how the receiver knows which envelope to open next. The TTL (Time to Live: 64) is a counter that every router lowers by one; you will need it when you study routing.

Sum check: 14 bytes of Ethernet header + 84 bytes of IP Total Length = 98 bytes on the wire.

Now click Source Address inside IPv4 and look at the bottom pane. Four bytes light up: 0a 01 00 0b. In decimal, 10.1.0.11: the address of pc1.

Display filters¶

A display filter tells Wireshark which frames to show. The others are only hidden, not deleted.

Type each one in the filter bar, press Enter, count the lines, clear the bar:

The last filter does not show frames 1 and 2, although they talk about that address. Why? An ARP frame has no IP header: ARP travels directly inside the Ethernet frame, so ip.addr has nothing to match. And in the ping, which layer was missing? Transport: no TCP, no UDP, no port.

Extra: your real card, live¶

Only if your teacher says live capture is enabled on your PC. In Wireshark: Capture → Options, choose the wired card, Start. In a host terminal: ping -c 2 1.1.1.1. Stop the capture (the red square) and filter icmp. Open the first request.

The destination IP is 1.1.1.1. But whose is the destination MAC? Run ip neigh on the host: it is the MAC of the classroom router. The frame only goes to the next hop; the packet goes all the way to the end. Remember this: it is the heart of routing, later in the unit.

Where people get stuck¶

• docker cp typed inside the container: open a host terminal, or exit first.
• The capture has 0 or 2 frames: tcpdump started after the ping, or the ARP cache was already full. On pc1 run ip neigh flush dev eth1 and capture again.
• The middle pane is empty: no frame is selected. Click one.

Clean up: close Wireshark, exit in pc1 and pc2, then containerlab destroy -t lan.clab.yml --cleanup.

Key takeaways¶

• A packet analyser copies and decodes every frame that reaches your card. Wireshark (born Ethereal, 1998) is the graphical one; tcpdump is the text one.
• Capture only your own machines and the lab.
• tcpdump -w saves a pcap file; Wireshark opens it in three panes: list, details (one line per layer), bytes.
• Each header has a field naming the next layer: Ethernet Type, IPv4 Protocol.
• Display filters (arp, icmp, eth.dst == …, ip.addr == …) only hide frames. ARP frames have no IP header.
• Wireshark only listens: it changes nothing on the network.

Quick check¶

Next: you have seen 10.G.0.11 inside a real packet. Now type addresses like it into real machines and make them ping each other, in Configuring TCP/IP on hosts.