Question

Wireshark question. I have PCAP file. How do I...

1) figure out what is the application in use and what is its purpose;

2) what application layer protocol is being employed, and what is the original RFC defining that protocol;

3) what is the IP address of each: the client and the server;

Answer 1

Wireshark :-> It is a network packet analyzer , A network packet analyzer will try to capture network and tries to display that packet data as detailed as possible

            We could think of a network packet analyzer as a measuring device used to examine what’s going on inside a network cable just like a voltmeter is used by an electrician cable ( but at a higher level of course ).

In the past , such tools were either very expensive proprietary or both , however, with the advent of wireshark all that has changed

1. Purpose

1. Network administrators use it to troubleshoot network problems
2. Network security engineers use it to examine security problems
3. QA engineers use it to verify network application
4. Developers use it to debug protocol implementation
5. People use it to learn network protocol intends

2. Application Layer provide an interface between software running on a computer and the network , it self example for this layer are

Telenet FTP, TFTP , SMTP , SNMP, DNS , etc

Ex      http://bhu.ac.in                   or https://bhu.ac.in

Not secure                                                   S-> Secure Socket Layer ( Its Secure )

A Request for Comments (RFC) :- It is a formal document drafted by the Internet Engineering Task Force (IETF) that describes the specifications for a particular technology. When an RFC is ratified, it becomes a formal standards document.

RFCs were first used during the creation of the ARPANET protocols that came to establish what became today's Internet. They continue to be issued on an ongoing basis as the technology underlying the Internet evolves.

3

It provides the facility client send and server give Response to client

When creating rules it is often important to know the IP address of each computer on the network. This tutorial demonstrates methods of obtaining the IP address information for each client, and building a list to be used to help configure the network's bandwidth usage.

IP addresses are values that identify computers on a network. Bandwidth Controller uses IP addresses extensively for its operation, including rule creation and configuration.

IP addresses are in the form of 'x.x.x.x' where each 'x' is a number ranging from 0 to 255. Examples of IP addresses on a network are '192.168.0.1', '10.0.0.1' and '207.83.254.67'.

Windows 2000, XP and 2003 Server make it possible to find the IP address of a computer with a single command called 'ipconfig'. To use this command, go to Start Menu, Run..., type cmd and click Ok.