Exit Zen
8
../../exercises/trace.rst:45
English
The following three lines of the tcpdump_ output correspond to TCP's three-way handshake. There are several interesting points to note in this output. First, ``Flags [S]`` indicates that the `SYN` flag was set in the first and second segments. In this first segment, tcpdump_ indicates the initial sequence number (``2681184541``). In the second segment, tcpdump_ indicates both the initial sequence number (``3804204915``) and the acknowledgment number (``2681184542``). Both segments contain TCP options. Starting in the third segment, tcpdump_ shows relative sequence numbers. Thus, the acknowledgment that you observe in the third segment is an acknowledgment for the `SYN` returned by the server.
0/7010 · 701
9
../../exercises/trace.rst:59
English
The two lines above correspond to the request sent by the client and the acknowledgment returned by the server. Note that the first byte sent by the client has `1` as relative sequence number. In this example, the HTTP request has a total length of 92 bytes. This request is immediately acknowledged by the server.
0/3140 · 314
10
../../exercises/trace.rst:62
English
The server then sends its response, which fits inside a single segment. The client acknowledges the reception of this segment.
0/1260 · 126
11
../../exercises/trace.rst:71
English
The TCP connection is then closed by exchanging three segments, the first two having the `FIN` flag set.
0/1040 · 104
12
../../exercises/trace.rst:79
English
tcpdump_ can provide more detailed information about the packets by using the `-v` or `-vv` option.
0/990 · 99
13
../../exercises/trace.rst:82
English
wireshark_ is more recent than tcpdump_. It evolved from the ethereal packet trace analysis software. It can be used as a text tool like tcpdump_. For a TCP connection, wireshark_ can provide almost the same output as tcpdump_. The main advantage of wireshark_ is that it also includes a graphical user interface that allows performing various types of analysis on a packet trace.
0/3800 · 380
14
../../exercises/trace.rst:88
English
Wireshark : default window
0/260 · 26
15
../../exercises/trace.rst:94
English
The wireshark_ window is divided in three parts. The top part of the window is a summary of the first packets from the trace. By clicking on one of the lines, you can show the detailed content of this packet in the middle part of the window. The middle of the window allows you to inspect all the fields of the captured packet. The bottom part of the window is the hexadecimal representation of the packet, with the field selected in the middle window being highlighted.
0/4700 · 470
16
../../exercises/trace.rst:96
English
wireshark_ is very good at displaying packets, but it also contains several analysis tools that can be very useful. The first tool is `Follow TCP stream`. It is part of the `Analyze` menu and allows you to reassemble and display all the payload exchanged during a TCP connection. This tool can be useful if you need to analyze for example the commands exchanged during an HTTP or SMTP session.
0/3930 · 393
17
../../exercises/trace.rst:98
English
The second tool is the flow graph that is part of the `Statistics` menu. It provides a time sequence diagram of the packets exchanged with some comments about the packet contents. See below for an example.
0/2050 · 205
18
../../exercises/trace.rst:104
English
Wireshark : flow graph
0/220 · 22
19
../../exercises/trace.rst:107
English
Use wireshark to analyze the packet traces described earlier :download:`traces/simple-trace.pcap`.
0/980 · 98
20
../../exercises/trace.rst:109
English
When analyzing packet traces with wireshark_, it is often very useful to use `Display filters` that only show the packets that match some specific criteria. There filters are described in several online documents:
0/2130 · 213
21
../../exercises/trace.rst:111
English
the `wireshark wiki <https://wiki.wireshark.org/>` page on `Display filters <https://wiki.wireshark.org/DisplayFilters>`_
0/1210 · 121
22
../../exercises/trace.rst:112
English
a nice `list of Wireshark Display Filters <https://networksecuritytools.com/list-wireshark-display-filters/>`_ by Robert Allen
0/1260 · 126
23
../../exercises/trace.rst:114
English
You can now use your understanding of wireshark_ and tcpdump_ to analyze a 2-minutes long packet trace.
0/1030 · 103
The translation has come to an end.