dreaife的休憩小栈

3.1 Basic tcpdump Usage#

tcpdump is a tool used to capture network packets and output their contents. With its powerful features and flexible capture filters, it has become the preferred tool on UNIX-like systems for network analysis and problem troubleshooting.

tcpdump supports filtering by network layer, protocol, host, network, or port, and provides logical statements such as and, or, not to help you weed out unnecessary information.

References:

https://www.cnblogs.com/ggjucheng/archive/2012/01/14/2322659.html

https://www.jianshu.com/p/d9162722f189

3.2 Basic Wireshark Usage#

Wireshark (formerly Ethereal) is a network packet analysis software. The function of network packet analysis software is to capture network packets and display as detailed packet information as possible. Wireshark uses WinPcap as the interface, exchanging data frames directly with the network card.

Network administrators use Wireshark to detect network problems; network security engineers use Wireshark to inspect information security related issues; developers use Wireshark to debug new communication protocols; ordinary users use Wireshark to learn about network protocols. Its interface is shown in the figure below.

References:

https://www.wireshark.org/#download

https://pc.qq.com/search.html#!keyword=wireshark

https://www.cnblogs.com/csnd/p/11807736.html

https://pc.qq.com/search.html#!keyword=xshell

3.3 Capture Packets with tcpdump and Analyze with Wireshark#

On the Alibaba Cloud host, run the command traceroute www.xju.edu.cn –T, and capture packets using tcpdump. Download the file to your local machine and analyze it with Wireshark.

Tips:

1. You must run the capture command first, then run the traceroute command. Capture command: tcpdump -i eth0 -w test.cap
2. You can download the data using the scp command or by using xshell and xftp.

1. Capture with tcpdump, analyze the captured data with wireshark, analyze the IP packet structure, and fill the IP protocol tree’s field names, field lengths, and field information into the table below.

2. Use Wireshark to analyze and interpret the relevant traceroute command results.

Tip: Set the Wireshark filter bar to display only ICMP

4.1 Basic tcpdump Usage#

tcpdump is a tool used to capture network packets and output their contents. With its powerful features and flexible capture filters, it has become the preferred tool on UNIX-like systems for network analysis and problem troubleshooting.

tcpdump supports filtering by network layer, protocol, host, network or port, and provides logical statements such as and, or, not to help you weed out useless information

• Default startup

1
tcpdump//普通情况下，直接启动tcpdump将监视第一个网络接口上所有流过的数据包。

• Capture packets on a specified network interface

1
tcpdump -i eth1//如果不指定网卡，默认tcpdump只会监视第一个网络接口，一般是eth0

4.2 Basic Wireshark Usage#

Wireshark (formerly Ethereal) is a network packet analysis tool. Its purpose is to capture network packets and display packet details as comprehensively as possible. Wireshark uses WinPcap as an interface to exchange data frames directly with the network card.

Network administrators use Wireshark to diagnose network issues, network security engineers use it to inspect information security problems, developers use it to debug new communication protocols, and ordinary users use it to learn about network protocols. Its interface is shown below.

4.3 Capture Packets with tcpdump and Analyze with Wireshark#

1. Execute the capture command tcpdump -i eth0 -w test.cap and store the captured information in the file /root/test.cap

1. Run the command traceroute www.xju.edu.cn –T

1. Use xftp to connect to the host, and save the captured packet file to your computer

1. Use wireshark to open the test.cap file, and analyze

1. For the captured packets, analyze the IP header structure and fill the IP protocol tree with the field names, lengths, and information into the table below.

1. Analyze and interpret the results of the related traceroute command execution, using ICMP to analyze the results.

Analysis results:

ICMP message types fall into two categories: ICMP error messages and ICMP echo messages. It can be seen that the ICMP messages we captured are all of type Time Exceeded in Transit, i.e., TTL exceeded. Choosing a random ICMP message, we can see that this ICMP message has Type=11, Code=0, which is an error-message type indicating time exceeded. Its checksum is 0x4e4d, which is correct, and the checksum status is good, with TTL equal to 4.

5.1 Problems and Solutions#

The problem when using the traceroute command produced the error -bash: traceroute: command not found. Solution: use yum install traceroute to install traceroute.
When connecting to the server with Xftp, connection errors occurred. Solution: reconnect via campus network; after investigation found the cause was the server firewall.

5.2 Reflections#

• This experiment familiarized me with the operation of code and software involved in IP protocol analysis, validating the knowledge learned in class. Through this experiment, I learned the concrete workflow for using the traceroute command, understood the basic usage of commonly used IP protocol analysis software, and improved my programming abilities.
• Through these common IP protocol analysis command operations, tracing IP protocol usage, this reinforced the knowledge taught in class.