Network traffic analysis
Budget: $30 – $250 USD
The goal of this assignment is to explore the network packets associated with several typical
online activities. To carry out this analysis, you will use Wireshark. While Wireshark allows you to capture packets on a network interface it can also be used to read previously collected packet traces. For this assignment you will be analyzing a trace that is already captured and is attached.
The deliverable of this assignment is a report in which you will explain what you saw in
the trace.
a)Answer the below questions with explanation.
i. How many packets are in the trace?
ii. What types of packets are these?
iii. What DLL/MAC addresses can you see in the trace?
iv. What IP addresses can you see in the trace?
v. How do IP and MAC addresses map to each other?
vi. Can you tell by the trace what kind of network card was used to
capture the trace: an Ethernet adapter or a 802.11 wireless card?
vii. Can you conclude anything about the network topology on which the
trace was collected? Which was the machine (IP and MAC address)
on which the trace was collected? What is the network mask? What
is the default gateway? What is the vendor of the default gateway
device? What is the DNS server IP? What is the DHCP server IP?
Which hosts are on the local network? How many hosts are there on
the local network? Can you determine some of the applications these
hosts are running? Which hosts are remote?
viii. How many hops away are the remote hosts? Which is the most
“remote” host?
ix. What services/applications were accessed?
x. Did any IP fragmentation occur? Were there any packets in which
the “Don’t fragment” bit was set?
i. Find the traceroute session. A part of the activity captured in this
trace is a traceroute session. Use what you know about traceroute
(e.g. packet types and how certain fields in the packets are modified)
in order to locate the traceroute packets in the pcap trace. Once you
find the packets, reconstruct the entire path from source to
destination. More specifically, draw a diagram with all the routers
and their respective IP addresses between the traceroute source and
the traceroute destination. In addition to the diagram, create a table
that contains the average RTT to each hop on the path.
2. Writing your report. Being able to convey what you have learned from the trace is
equally important to understanding what is going on in the trace. This section
provides you with guidelines on how to organize your understanding of the trace in
a nice, coherent story, so your reader can also learn from your knowledge.
a. Paper format: your submission will be a single PDF file.
b. Paper content. Your paper will need to answer the questions above plus any
other interesting things you have found in the trace. While the above
questions provide a nice framework to analyze the trace, answering them
one by one in the report will not lead to a nice coherent story; instead it will
produce a hard to read and hard to understand bucket list. When writing
your report consider presenting your findings in multiple levels of detail. For
example, you can first provide a summary of the trace including number of
packets, number of hosts and a high-level idea of what these hosts are up to.
A figure that depicts the local network architecture, and “interesting”
internal and external hosts will make your story visually clear. Then
describe the different services/applications you see. For each service dive in
details about the packet trace associated with this service. What transport
layer protocol did it use? Was that aligned with what we studied throughout
the semester? Did you see anything unexpected? Describe the packets you
see in the flow associated with this service. Include diagrams where
appropriate. You can then conclude your report with a brief summary of
what you learned from this trace. Note that reports must contain a description
of the traceroute session and the RTT into each hop.
online activities. To carry out this analysis, you will use Wireshark. While Wireshark allows you to capture packets on a network interface it can also be used to read previously collected packet traces. For this assignment you will be analyzing a trace that is already captured and is attached.
The deliverable of this assignment is a report in which you will explain what you saw in
the trace.
a)Answer the below questions with explanation.
i. How many packets are in the trace?
ii. What types of packets are these?
iii. What DLL/MAC addresses can you see in the trace?
iv. What IP addresses can you see in the trace?
v. How do IP and MAC addresses map to each other?
vi. Can you tell by the trace what kind of network card was used to
capture the trace: an Ethernet adapter or a 802.11 wireless card?
vii. Can you conclude anything about the network topology on which the
trace was collected? Which was the machine (IP and MAC address)
on which the trace was collected? What is the network mask? What
is the default gateway? What is the vendor of the default gateway
device? What is the DNS server IP? What is the DHCP server IP?
Which hosts are on the local network? How many hosts are there on
the local network? Can you determine some of the applications these
hosts are running? Which hosts are remote?
viii. How many hops away are the remote hosts? Which is the most
“remote” host?
ix. What services/applications were accessed?
x. Did any IP fragmentation occur? Were there any packets in which
the “Don’t fragment” bit was set?
i. Find the traceroute session. A part of the activity captured in this
trace is a traceroute session. Use what you know about traceroute
(e.g. packet types and how certain fields in the packets are modified)
in order to locate the traceroute packets in the pcap trace. Once you
find the packets, reconstruct the entire path from source to
destination. More specifically, draw a diagram with all the routers
and their respective IP addresses between the traceroute source and
the traceroute destination. In addition to the diagram, create a table
that contains the average RTT to each hop on the path.
2. Writing your report. Being able to convey what you have learned from the trace is
equally important to understanding what is going on in the trace. This section
provides you with guidelines on how to organize your understanding of the trace in
a nice, coherent story, so your reader can also learn from your knowledge.
a. Paper format: your submission will be a single PDF file.
b. Paper content. Your paper will need to answer the questions above plus any
other interesting things you have found in the trace. While the above
questions provide a nice framework to analyze the trace, answering them
one by one in the report will not lead to a nice coherent story; instead it will
produce a hard to read and hard to understand bucket list. When writing
your report consider presenting your findings in multiple levels of detail. For
example, you can first provide a summary of the trace including number of
packets, number of hosts and a high-level idea of what these hosts are up to.
A figure that depicts the local network architecture, and “interesting”
internal and external hosts will make your story visually clear. Then
describe the different services/applications you see. For each service dive in
details about the packet trace associated with this service. What transport
layer protocol did it use? Was that aligned with what we studied throughout
the semester? Did you see anything unexpected? Describe the packets you
see in the flow associated with this service. Include diagrams where
appropriate. You can then conclude your report with a brief summary of
what you learned from this trace. Note that reports must contain a description
of the traceroute session and the RTT into each hop.