Assignment

Overview: For this lab, you will analyze 5 Wireshark files (provided to you). Download these files from the desktop of Lab Resources, locate the PCAP files and place them in a location within WINATK01 where you can find them (Wireshark files have the extension name of .pcap).

The 5 files you are going to analyze are:

1. mysql_complete.pcap
2. HTTP.pcap
3. ospf simple password authentication.pcap
4. telnet.pcap
5. gmail.pcapng.pcap

As you analyze the results of each file, consider the following questions:

• what are the unique pair of IP addresses that are communicating with one another, based on their being noted in the Source and Destination addresses in the top frame of Wireshark's data display?

• For each unique pair of IP addresses communicating, what protocol(s) does Wireshark indicate that they are using?

• What port numbers are indicated as being used for the source and destination, when you click on a packet line in the top frame and open the Transmission Control Protocol in the middle frame? Identify the port numbers (Src Port and Dst Port) for each unique pair of IP addresses communicating for each unique protocol they are using (like TCP or HTTP, and so forth).

• What are the MAC Addresses for each of the unique pair of machines that are communicating with one another? (HINT: this can be see in the middle frame on the line that is for the Ethernet II layer, and a MAC address is indicated as six double digit numbers separated by colons).

• What plaintext information (if any) can you find in any of the packets in the upper frame of Wireshark, when you select the bottom most OSI layer in the bottom row in the middle frame, when you look at the hexidecimal and ASCII interpretation of the data in the packet in the lower frame of the window?