Network Analyzer Example
Internet



User clicks on http://www.nytimes.com/
Ethereal network analyzer captures all frames
observed by its Ethernet NIC
Sequence of frames and contents of frame can be
examined in detail down to individual bytes
Ethereal web site, http://www.ethereal.com/
(This material is for self study.))
Ethereal Protocol Analyzer




A network protocol analyzer is a tool for capturing, displaying, and analyzing
the PDUs that are exchanged in a network. Current analyzers cover a very
broad range of protocols and are constantly being updated. Protocol analyzers
are also extremely useful in teaching the operation of protocols by providing a
means of examining traffic from a live network.
Communication Networks uses the Ethereal open source package, which
supports an extensive set of protocols, including: PPP, HDLC, Ethernet, MPLS,
IP, IPv6, ARP, ICMP, RIP, OSPF, UDP, TCP, DNS, HTTP, telnet, FTP, RSVP,
RTP, SIP, H.323, SSL and TLS, PING, and traceroute.
Ethereal can be run in two modes. In the first mode, the Ethereal application
opens existing packet capture files for analysis. In the second mode the Ethereal
application captures a frame sequence in real time and then stores the result in a
packet capture file. In this document we provide a number of packet capture
files that can be used by the instructor to demonstrate and analyze protocols in
class. In a separate document we provide lab experiments for capturing these
frame sequences.
The Ethereal package can be downloaded from www.ethereal.com. Their web
site also contains instructions and example screen captures.
Ethereal windows
Top Pane shows
frame/packet
sequence
Middle Pane
shows
encapsulation for
a given frame
Bottom Pane shows hex & text
Top pane: frame sequence
DNS
Query
TCP
Connection
Setup
HTTP
Request &
Response
Middle pane: Encapsulation
Ethernet Frame
Protocol Type
Ethernet
Destination and
Source
Addresses
Middle pane: Encapsulation
And a lot of
other stuff!
IP Packet
IP Source and
Destination
Addresses
Protocol Type
Middle pane: Encapsulation
TCP Segment
Source and
Destination Port
Numbers
GET
HTTP
Request