CN5 Wireshark: capture TCP/IP packets, 3-way handshake

  1. Terminal (Ctrl+Alt+T): sudo wireshark
  2. Double-click your interface (moving line: enp0s3 / eth0 / wlo1)
  3. Second terminal: run the command for your case (below)
  4. Click the RED square to stop
  5. Type the filter in the green bar > Enter
  6. Click a packet > look at the middle pane > screenshot
Screen 1: after sudo wireshark (double-click the highlighted interface)
FileEditViewGoCaptureAnalyzeStatisticsTelephonyWirelessToolsHelp
↻ ⚙ | 🔍 ← →
Apply a display filter ... <Ctrl-/>
Welcome to Wireshark · Capture
enp0s3 ▁▂▅▃▇▂
any ▁▂▄▂▆▁
Loopback: lo ▁▁▁▂▁▁
bluetooth-monitor
nflog
Ready to load or captureProfile: Default
Screen 2: capture stopped, filter typed (tcp) - first 3 rows = 3-way handshake
FileEditViewGoCaptureAnalyzeStatisticsTelephonyWirelessToolsHelp
↻ ⚙ | 🔍 ← →
tcp
No.TimeSourceDestinationProtocolLengthInfo
10.000000192.168.1.534.223.124.45TCP7451812 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460
20.23118434.223.124.45192.168.1.5TCP7480 → 51812 [SYN, ACK] Seq=0 Ack=1 Win=26847 Len=0
30.231240192.168.1.534.223.124.45TCP6651812 → 80 [ACK] Seq=1 Ack=1 Win=64256 Len=0
40.231377192.168.1.534.223.124.45HTTP141GET / HTTP/1.1
50.46290334.223.124.45192.168.1.5TCP6680 → 51812 [ACK] Seq=1 Ack=76 Win=27008 Len=0
60.46355134.223.124.45192.168.1.5HTTP2894HTTP/1.1 200 OK (text/html)
▸ Frame 1: 74 bytes on wire (592 bits)
▸ Ethernet II, Src: 08:00:27:3a:1b:7e, Dst: 52:54:00:12:35:02
▸ Internet Protocol Version 4, Src: 192.168.1.5, Dst: 34.223.124.45
▸ Transmission Control Protocol, Src Port: 51812, Dst Port: 80, Seq: 0, Len: 0 (Flags: SYN)
Packets: 214 · Displayed: 38Profile: Default

A. 3-way handshake (most common)

B. TCP/IP layers

C. Monitor browsing habits

If something goes wrong

Commands
sudo wireshark
curl http://neverssl.com
Filters (green bar)
tcp
udp
dns
http
icmp
arp
ip.addr == 8.8.8.8
tcp.port == 80
tcp.flags.syn==1
tls.handshake.extensions_server_name
If not installed (say Yes to non-superusers)
sudo apt install -y wireshark
video not playing? open on YouTube
video not playing? open on YouTube
What is Wireshark?
Free packet analyser that captures and shows network traffic.
3 panes?
Packet list (top), packet details / layers (middle), raw bytes in hex (bottom).
Capture filter vs display filter?
Capture filter decides what is recorded; display filter (green bar) only hides packets after capture.
3-way handshake?
SYN > SYN-ACK > ACK to start a TCP connection. Close: FIN, ACK, FIN, ACK.
Why can't you read HTTPS?
It is encrypted; only IPs, ports and site name are visible.

CN4 Static routing and RIP (dynamic routing) in Packet Tracer

  1. Drag 2 Router-PT + 2 PCs. PC-Router = Copper Cross-Over. Router-Router = Serial DCE (Router0 first)
  2. Set PC0 and PC1 IP + gateway (Desktop > IP Configuration)
  3. Router0 CLI: paste 'Router0' box. Router1 CLI: paste 'Router1' box
  4. Then paste STATIC box (or RIP box if slip says dynamic / RIP) on each router
  5. PC0 Command Prompt: ping 192.168.2.2 > replies = done
PC0PC1R0R1192.168.1.2GW 192.168.1.1Fa0/0 192.168.1.1Se2/0 10.0.0.1clock 64000Se2/0 10.0.0.2Fa0/0 192.168.2.1192.168.2.2GW 192.168.2.1cross-overserial DCEcross-over
Router0
no
enable
configure terminal
interface fastEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 no shutdown
 exit
interface serial2/0
 ip address 10.0.0.1 255.0.0.0
 clock rate 64000
 no shutdown
 exit
Router1
no
enable
configure terminal
interface fastEthernet0/0
 ip address 192.168.2.1 255.255.255.0
 no shutdown
 exit
interface serial2/0
 ip address 10.0.0.2 255.0.0.0
 no shutdown
 exit
STATIC (Router0 line, then Router1 line)
ip route 192.168.2.0 255.255.255.0 10.0.0.2
end

ip route 192.168.1.0 255.255.255.0 10.0.0.1
end
RIP (Router0, then Router1)
router rip
 version 2
 network 192.168.1.0
 network 10.0.0.0
 end

router rip
 version 2
 network 192.168.2.0
 network 10.0.0.0
 end
Check on router
show ip route
video not playing? open on YouTube
video not playing? open on YouTube

CN3 Topologies (Bus, Star, Ring, Mesh) in Packet Tracer

  1. Drag Switch 2960 (Network Devices > Switches) and PCs (End Devices)
  2. Connect like the picture: lightning icon = automatic cable
  3. Click PC > Desktop > IP Configuration > type the red IP, mask 255.255.255.0
  4. Wait till link dots are green (one orange in ring/mesh is normal)
  5. Test: PC0 > Desktop > Command Prompt > ping the last PC's IP
Switch0PC0192.168.1.10PC1192.168.1.11PC2192.168.1.12PC3192.168.1.13
video not playing? open on YouTube

CN7 TCP socket programming (client-server, reverse sentence)

  1. gedit tcp_server.c > paste SERVER > save. gedit tcp_client.c > paste CLIENT > save
  2. Terminal 1: gcc tcp_server.c -o server then ./server
  3. Terminal 2: gcc tcp_client.c -o client then ./client
  4. Type a sentence > reverse comes back. Ctrl+D to stop
SERVER tcp_server.c
/* EXP 7: TCP Server - receives a sentence, sends back its reverse (port 5777) */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <sys/socket.h>

#define PORT 5777
#define MAX 1024

int main(void) {
    int listenfd, connfd, n, i;
    char line[MAX], rev[MAX];
    struct sockaddr_in servaddr, cliaddr;
    socklen_t clilen = sizeof(cliaddr);

    listenfd = socket(AF_INET, SOCK_STREAM, 0);            /* 1. socket  */
    int opt = 1;
    setsockopt(listenfd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
    memset(&servaddr, 0, sizeof(servaddr));
    servaddr.sin_family = AF_INET;
    servaddr.sin_addr.s_addr = htonl(INADDR_ANY);
    servaddr.sin_port = htons(PORT);
    if (bind(listenfd, (struct sockaddr *)&servaddr, sizeof(servaddr)) < 0) {  /* 2. bind */
        perror("bind"); exit(1);
    }
    listen(listenfd, 5);                                      /* 3. listen  */
    printf("Server waiting on port %d...\n", PORT);

    connfd = accept(listenfd, (struct sockaddr *)&cliaddr, &clilen);  /* 4. accept */
    printf("Connected to client %s\n", inet_ntoa(cliaddr.sin_addr));

    while ((n = read(connfd, line, MAX - 1)) > 0) {          /* 5. read */
        line[n] = '\0';
        if (line[n - 1] == '\n') line[--n] = '\0';
        printf("Received : %s\n", line);
        for (i = 0; i < n; i++) rev[i] = line[n - 1 - i];    /* reverse */
        rev[n] = '\0';
        write(connfd, rev, n + 1);                           /* 6. write */
        printf("Sent back: %s\n", rev);
    }
    printf("Client disconnected\n");
    close(connfd);
    close(listenfd);                                         /* 7. close */
    return 0;
}
CLIENT tcp_client.c
/* EXP 7: TCP Client - sends a sentence, prints the reversed reply (port 5777) */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <sys/socket.h>

#define PORT 5777
#define MAX 1024

int main(void) {
    int sockfd, n;
    char sendline[MAX], revline[MAX];
    struct sockaddr_in servaddr;

    sockfd = socket(AF_INET, SOCK_STREAM, 0);               /* 1. socket  */
    memset(&servaddr, 0, sizeof(servaddr));
    servaddr.sin_family = AF_INET;
    servaddr.sin_port = htons(PORT);
    servaddr.sin_addr.s_addr = inet_addr("127.0.0.1");       /* server IP */
    /* 2. connect */
    if (connect(sockfd, (struct sockaddr *)&servaddr, sizeof(servaddr)) < 0) {
        perror("connect"); exit(1);
    }
    printf("Connected. Enter sentences (Ctrl+D to quit):\n");
    while (fgets(sendline, MAX, stdin) != NULL) {
        write(sockfd, sendline, strlen(sendline));          /* 3. write */
        n = read(sockfd, revline, MAX - 1);                 /* 4. read  */
        if (n <= 0) break;
        revline[n] = '\0';
        printf("Reverse of the given sentence is: %s\n", revline);
    }
    close(sockfd);                                          /* 5. close */
    return 0;
}
video not playing? open on YouTube

CN8 UDP socket programming (chat until exit)

  1. Save udp_server.c and udp_client.c (gedit)
  2. Terminal 1: gcc udp_server.c -o userver then ./userver
  3. Terminal 2: gcc udp_client.c -o uclient then ./uclient
  4. Client types first, server replies, exit to stop
SERVER udp_server.c
/* EXP 8: UDP Server - two-way chat with client until "exit" (port 5777) */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <sys/socket.h>

#define PORT 5777
#define MAX 1024

int main(void) {
    int sockfd, n;
    char buf[MAX];
    struct sockaddr_in servaddr, cliaddr;
    socklen_t len = sizeof(cliaddr);

    sockfd = socket(AF_INET, SOCK_DGRAM, 0);                /* 1. socket (UDP) */
    memset(&servaddr, 0, sizeof(servaddr));
    servaddr.sin_family = AF_INET;
    servaddr.sin_addr.s_addr = htonl(INADDR_ANY);
    servaddr.sin_port = htons(PORT);
    if (bind(sockfd, (struct sockaddr *)&servaddr, sizeof(servaddr)) < 0) {  /* 2. bind */
        perror("bind"); exit(1);
    }
    printf("UDP server waiting on port %d...\n", PORT);

    while (1) {
        /* 3. recvfrom */
        n = recvfrom(sockfd, buf, MAX - 1, 0, (struct sockaddr *)&cliaddr, &len);
        buf[n] = '\0';
        printf("Client: %s\n", buf);
        if (strncmp(buf, "exit", 4) == 0) break;

        printf("Server: ");
        if (!fgets(buf, MAX, stdin)) break;
        buf[strcspn(buf, "\n")] = '\0';
        /* 4. sendto */
        sendto(sockfd, buf, strlen(buf), 0, (struct sockaddr *)&cliaddr, len);
        if (strncmp(buf, "exit", 4) == 0) break;
    }
    printf("Chat ended\n");
    close(sockfd);
    return 0;
}
CLIENT udp_client.c
/* EXP 8: UDP Client - two-way chat with server until "exit" (127.0.0.1:5777) */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <sys/socket.h>

#define PORT 5777
#define MAX 1024

int main(void) {
    int sockfd, n;
    char buf[MAX];
    struct sockaddr_in servaddr;
    socklen_t len = sizeof(servaddr);

    sockfd = socket(AF_INET, SOCK_DGRAM, 0);                /* 1. socket (UDP) */
    memset(&servaddr, 0, sizeof(servaddr));
    servaddr.sin_family = AF_INET;
    servaddr.sin_port = htons(PORT);
    servaddr.sin_addr.s_addr = inet_addr("127.0.0.1");

    while (1) {
        printf("Client: ");
        if (!fgets(buf, MAX, stdin)) break;
        buf[strcspn(buf, "\n")] = '\0';
        /* 2. sendto */
        sendto(sockfd, buf, strlen(buf), 0, (struct sockaddr *)&servaddr, len);
        if (strncmp(buf, "exit", 4) == 0) break;

        /* 3. recvfrom */
        n = recvfrom(sockfd, buf, MAX - 1, 0, NULL, NULL);
        buf[n] = '\0';
        printf("Server: %s\n", buf);
        if (strncmp(buf, "exit", 4) == 0) break;
    }
    printf("Chat ended\n");
    close(sockfd);
    return 0;
}
video not playing? open on YouTube

CN9 DHCP and Email (SMTP / POP3) in Packet Tracer

  1. Server > Desktop > IP Configuration > Static 192.168.1.2 / 255.255.255.0
  2. Server > Services > DHCP: fill like picture > Add / Save
  3. Each PC > Desktop > IP Configuration > DHCP (gets 192.168.1.10, .11)
  4. Server > Services > EMAIL: domain college.com, add student1/123 and student2/123
  5. PC0 and PC1 > Desktop > Email: fill like picture
  6. PC0 Compose to student2@college.com > Send. PC1 > Receive
Server0192.168.1.2 staticSwitch0PC0DHCPPC1DHCP
video not playing? open on YouTube

CN1 Basic commands: ping, traceroute, ifconfig, netstat, arp, nslookup

  1. Open terminal: Ctrl+Alt+T
  2. Run the install line once (asks password)
  3. Run each command below, screenshot each output
  4. Exercise: run the 4 ping options at the end
Commands
sudo apt install -y net-tools traceroute dnsutils

ifconfig
ip a
ping -c 4 google.com
traceroute google.com
netstat -r
netstat -tuln
arp -a
nslookup google.com
dig google.com

ping -c 5 google.com
ping -i 2 -c 4 google.com
ping -s 1000 -c 4 google.com
ping -t 3 -c 3 google.com
video not playing? open on YouTube

CN2 netstat & route: routing table, add / delete route, change default gateway

  1. Run ip route | grep default > note YOUR gateway (e.g. 192.168.0.1) and interface (e.g. enp3s0)
  2. In the box replace 192.168.0.1 and enp3s0 with YOUR values
  3. Run line by line, screenshot route -n after each change
  4. Last 2 lines restore internet: run them at the end
Commands
netstat -rn
route -n
ip route show

sudo route add -net 10.10.10.0 netmask 255.255.255.0 gw 192.168.0.1 dev enp3s0
route -n
sudo route del -net 10.10.10.0 netmask 255.255.255.0 gw 192.168.0.1 dev enp3s0
route -n

sudo route del default gw 192.168.0.1
sudo route add default gw 192.168.0.254 dev enp3s0
route -n

sudo route del default gw 192.168.0.254
sudo route add default gw 192.168.0.1 dev enp3s0
video not playing? open on YouTube

CN6 Wireshark: security threats and suspicious traffic

  1. Terminal (Ctrl+Alt+T): sudo wireshark
  2. Double-click your interface (moving line: enp0s3 / eth0 / wlo1)
  3. Second terminal: run the command for your case (below)
  4. Click the RED square to stop
  5. Type the filter in the green bar > Enter
  6. Click a packet > look at the middle pane > screenshot
Port scan (sudo nmap -sS 127.0.0.1, capture on Loopback: lo, filter tcp.flags.syn==1)
FileEditViewGoCaptureAnalyzeStatisticsTelephonyWirelessToolsHelp
↻ ⚙ | 🔍 ← →
tcp.flags.syn==1
No.TimeSourceDestinationProtocolLengthInfo
10.000000127.0.0.1127.0.0.1TCP5834754 → 111 [SYN] Seq=0 Win=1024 Len=0 MSS=1460
30.000035127.0.0.1127.0.0.1TCP5834754 → 110 [SYN] Seq=0 Win=1024 Len=0 MSS=1460
50.000043127.0.0.1127.0.0.1TCP5834754 → 23 [SYN] Seq=0 Win=1024 Len=0 MSS=1460
70.000050127.0.0.1127.0.0.1TCP5834754 → 135 [SYN] Seq=0 Win=1024 Len=0 MSS=1460
90.000098127.0.0.1127.0.0.1TCP5834754 → 53 [SYN] Seq=0 Win=1024 Len=0 MSS=1460
110.000106127.0.0.1127.0.0.1TCP5834754 → 80 [SYN] Seq=0 Win=1024 Len=0 MSS=1460
▸ one source port → many destination ports in milliseconds = PORT SCAN (suspicious)
Packets: 403 · Displayed: 202Profile: Default
CaseCommandFilterNormalSuspicious
DNSnslookup google.comdnsquery + responsehundreds of queries, long random names
ICMPping -c 10 8.8.8.8icmprequest + reply pairshuge number of pings from one IP (ICMP flood)
ARPping -c 2 <your gateway>arpWho has X? Tell Y + X is at MACone IP with 2 different MACs (ARP spoofing)
HTTPcurl http://neverssl.comhttpGET + 200 OKpasswords visible in plain text
Port scansudo nmap -sS 127.0.0.1tcp.flags.syn==1-one IP sends SYN to many ports in ms

Notes

If something goes wrong

Commands
nslookup google.com
ping -c 10 8.8.8.8
ip route | grep default
ping -c 2 192.168.0.1
curl http://neverssl.com
sudo apt install -y nmap
sudo nmap -sS 127.0.0.1
Filters
dns
icmp
arp
http
tcp.flags.syn==1
arp.duplicate-address-detected
video not playing? open on YouTube

CN10 Comparative study: Packet Tracer vs GNS3 vs Wireshark

Packet TracerGNS3Wireshark
TypeSimulatorEmulator (real IOS)Packet analyser
ByCiscoOpen sourceOpen source
NeedsLow PC powerHigh RAM/CPULow
UseLearning, CCNAReal-like labsCapture, troubleshoot
CostFreeFree (images licensed)Free

EXTRA Old lab manual extras: iptables packet filtering, crimping

  1. iptables: run the box line by line, show the rule list after each step
  2. Crimping: RJ45 + Cat6 cable, colour order T-568B: orange-white, orange, green-white, blue, blue-white, green, brown-white, brown
  3. Straight cable = same order both ends. Cross-over = T-568A one end, T-568B other end
iptables
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -L -n -v
sudo iptables -A INPUT -p icmp -j DROP      # block ping
ping -c 2 127.0.0.1                         # now fails
sudo iptables -L -n --line-numbers
sudo iptables -D INPUT 1                    # remove the rule
ping -c 2 127.0.0.1
video not playing? open on YouTube

VIVA per experiment

CN1 ping uses? ICMP echo request / reply | TTL? Max hops; each router -1; 0 = dropped | ARP? IP address > MAC address
CN2 Default gateway? Router used when no route matches (0.0.0.0) | Flag G? Route goes via a gateway | Permanent? No, lost on reboot
CN3 Hub vs switch? Hub sends to all ports; switch only to the right MAC | Mesh links for n? n(n-1)/2, 4 PCs = 6 | Straight vs cross? Straight: different devices; cross: same devices
CN4 Static vs dynamic? Static typed by admin; dynamic learned automatically | RIP metric? Hop count, max 15, updates every 30 s | AD values? Connected 0, static 1, RIP 120
CN5 3-way handshake? SYN > SYN-ACK > ACK | TCP vs UDP? TCP reliable, connection; UDP fast, no connection | 3 panes? Packet list, details, bytes
CN6 ARP spoofing? Fake ARP replies to steal traffic (MITM) | Port scan sign? Many SYN from one IP to many ports | Why HTTP risky? Plain text, passwords visible
CN7 SOCK_STREAM? TCP socket | Server calls? socket, bind, listen, accept, read/write, close | htons? Port to network byte order
CN8 SOCK_DGRAM? UDP socket | No listen/accept? UDP is connectionless | Calls? sendto, recvfrom
CN9 DHCP steps? DORA: Discover, Offer, Request, Ack | SMTP vs POP3? SMTP sends (25); POP3 receives (110) | DHCP ports? UDP 67 / 68