Royal Military College of Canada

Department of Electrical and Computer Engineering

EEE473 Computer Network Design
Dr G.S. Knight
Dr S. Leblanc

Lab 2 - Introduction to Network Configuration and Packet Capture

References

  1. WinDump Manual

Objectives

This lab aims to:

Introduction

This lab is a further introduction to the laboratory environment in Lab 4112. You will configure a small network consisting of some laboratory computers, a central computer hosting a telnet server, an ftp server and a web server, an Ethernet hub and patch panel. You will also use a packet capture tool to provide data dumps of the traffic being carried on the network. Analysis of these dump files will help you understand the nature of datagram based network communication and the layering of network protocols.

Part 1 - Building a small network

Figure 1 - Network Configuration

Figure 1 - Network Configuration

Part 2 - Setting up printing using a local "Standard TCP/IP port"

To print you will need to add a new printer to the Windows environment. Do this by going to the Printers and Faxes tool in the Windows control panel. Only do this once your network is set up and you were successful in pinging the printer.
You should now be able to print using the Lexmark printer.

Part 3 - Analysis of network packet capture data

The tool windump is a port of the popular tcpdump. You will use windump to capture and analyze network traffic.  Run the windump program in a Command Prompt shell. First run windump with the -D switch to discover the names and numbers of the network interfaces on your computer (eg. windump -D); note that case matters. You will also notice that the adapters listed by Windows are "cryptic", however only the External adapter should be enabled at this stage.
Now invoke windump and suppress host and port number lookup using the -n switch
(#1) Ensure that you understand why this usage is so important. As each packet is read by windump, what happens if the -n switch is omitted? 
In another Command Prompt, use a telnet session to communicate over the network with the Server VM using user alice as before.
Observe the packet-by-packet network activity reported by windump. Intermingled with the telnet packets you might also notice a good deal of other network traffic.  This traffic is likely associated with some of the built-in services of the Windows operating system.  There may also be packets associated with the other student's computers on the network.
Without any filtering applied, all the traffic being presented can lead to a very cluttered output.  windump has a number of "expressions" that can be specified on the command line when it is run.  The expressions allow the user to filter the traffic and only report that traffic which is useful for some specific experiment. For example, filter out all traffic except that associated with your telnet session with the Server, knowing that telnet traffic flows to the well-known port number 23 at the telnet server.  Therefore we can filter out all the traffic except our telnet session by specifying: host "10.27.x.20 and port 23" when we invoke the program on the command line. Note that command ordering should follow the convention: command <switch> <option> <filter>.  Try this and observe the result; do not forget to include switches such as -i and -n. You should now only see your own telnet traffic.

The windump program also has switches that allow it to report additional interesting information about the network traffic as it dumps the data to the output screen.  To see a complete list of all the switches available you can look in the windump manual pages or refer to the handout provided with this lab.  Specifically you should read the sections of the manual pages that deal with the following switches and record their meanings (we expect much more than regurgitation of the information from the man page; you must discuss):

#3 -
Switch
Meaning
-D
                                                                                                                                                                                        
-i

-e

-v

-X

(#4) When using the -s switch, how do you ensure that you get whole packets? Experiment with the snaplen to make sure you understand its use

Invoke windump again to filter only your telnet traffic. Use the appropriate switches to dump the whole packets, provide a raw hex form of the output and also the ASCII representation of this hex dump. The hex dump provides a view of each byte that was transmitted in the IP packet.  The ASCII translation of this can sometimes be useful as the payload portions of the telnet traffic are ASCII. For example, if you do a directory listing over the telnet session you can easily read the directory contents in the windump data. On the other hand the data associated with the TCP and IP headers is numeric encoding and is not representative of any ASCII text. windump still tries to do an ASCII decoding for all the data and reports it. In this case you only see some characters of gibberish and periods in the places where non-printable ASCII codes were present.  These hex and ASCII formats for displaying the data can be useful for understanding and debugging a network protocol. Capture your windump command with appropriate switches in the box below, and provide a detailed explanation of each of its components in your report (#5).

You are now to conduct the following experiments and report on them in your lab submission.
  1. Use windump to filter whole packets of only your telnet traffic.  Output the packets in both raw hex and ASCII format.  Pipe the command output to a file using  the ">" operator. 
  2. Using a text editor (such as WordPad or NotePad) open this file and prepare a small sample for printing that includes some interesting telnet payload data; one page is sufficient. You can print this from the lab, or better yet save the file to a USB key and integrate it in your report.
  3. Use windump to isolate the traffic from another student's machine. Get them to log in to bob's account (password hidden) over the network while you are listening. Use windump to steal the password. Provide the packet trace used in your analysis and indicate what part of the packet was useful.
  4. Use windump to report on the link layer addresses of the network communication. Reproduce the network diagram in your lab report (the source file is here) and ensure that your network diagram includes:

Part 4 - Capturing network traffic in packet capture files and replaying it

Sure, it is interesting to conduct some analysis in the lab, but odds are good that you will realize that you forgot something when you are writing the report at 0200 hrs before the lab report is due; would it not be nice to conduct analysis at home? You will now investigate the use of two more windump switches -w and -r.
#6 -
Switch
Meaning
-w
                                                                                                                                                                                        
-r

Conduct the following experiment:
        #7: _________________________________________________
        #8: _________________________________________________

When you are finished the lab, do not forget to follow the instructions in the preamble to properly shut down your Windows VM and log out of your host machine. Ensure that the you leave the cage in the same state you found it, and ask the instructor for the key-press combination so you can work here after hours.

Submit your lab report by e-mail. Place files together in a  zip file before sending. Include your report and network traffic dump files.