CT320: Network and System Administration
Fall 2018
Packet Sniffing
The purpose of this assignment is to learn about network protocols by using a “packet sniffer” to examine network traffic on the local area network in our lab.
For this assignment you will create a document called R7.txt with a
section for each network protocol that you capture using the packet
sniffer. For this recitation we are using the tcpdump packet sniffer.
First, find out the name of your network interface.
eno0,
or sometimes eth0.
ip route command shows your interface name.
Here is a sample tcpdump command:
sudo tcpdump -A -i eno0 'tcp port https and host google.com' | tee log
Open your web browser and go to www.google.com.
sudo?
-A do?
-i eno0 do?
| tee log do?
Packet sniffers capture network traffic by listening to the interface on the local system, thus all LAN traffic is detected. Make sure you know how to specify the interface and how to dump an ASCII interpretation of the packets. The filtering mechanism in tcpdump is very useful for this assignment, since it allows the user to filter out unwanted traffic.
Use tcpdump to capture an HTTP request and reply from:
http://icanhazip.com/
Use tcpdump to capture an HTTPS (did you see the ‘S’?) request and
reply from: https://cs.colostate.edu/~ct320/alphabet.txt
For each protocol in the following list, use tcpdump to capture the
associated packets, and explain the purpose and size of each
request and reply:
This is the format of your explanation:
Use tcpdump to find at least two other protocols that are ongoing in
the network lab. List your answers in the same format as the previous
section.
Show your R7.txt to the TA for credit.
