Exercise 1: Wireshark
Name: ________________________________
Sunet ID: ________________________________@ stanford.edu
Background
Wireshark is a tool for inspecting packets sent/received on a network interface. There are two
modes: Open and Capture. Capture mode shows you a live stream of the packets currently
going to/from the interface, which you can then save to a pcap file if you like.
Open allows you to inspect a pcap previously generated by some capture.
If you want to look at two pcap files simultaneously, the best way I’ve found is to start two
instances of Wireshark -- e.g. on Mac, open -n /Applications/Wireshark.app
Pcap 1: Ping
Open ping.pcap, which captures a single ping from one host to another.
Don’t worry about the details of the ARP packets for now. We’ll learn later that ARP is a
discovery protocol for finding the Ethernet address to use when sending to a local IP address.
1. What is the IP address of the host being pinged? 192.168.2.1
2. What are the 3 layers in packet 1, starting with the outermost?
Outermost: Ethernet Middle: IP Innermost: ICMP
3. Does the innermost protocol identified in (2) use ports? No; ICMP doesn’t need to
multiplex across multiple applications like TCP does
4. For packet 1, label the length (in bytes) of each portion on the diagram.
Hint
: The lengths should sum to 98 (the total length of the packet)
Wireshark shows lengths in bottom left when you click on the header, although for
the ICMP header it includes the payload length)
48 16 (64-48) 20 14
Pcap 2: SMTP
Open smtp.pcapng, which captures an SMTP conversation similar to the one in lab 0.
In your answers, use the Wireshark packet number (the “No.” column) to identify packets.
