{
    "id": "b6022d69-f16d-4f81-a54b-9f56e101b158",
    "name": "Traffic Analysis Using Wireshark - Part 1",
    "slug": "traffic-analysis-using-wireshark-part-1",
    "status": "published",
    "lab_type": "pta",
    "is_sample": false,
    "duration_in_seconds": 1800,
    "metadata": {
        "courses": [
            "cd60ce4a-1b83-48c4-8d38-7e6bfeab4a1e"
        ],
        "pta_sdn": "58",
        "pta_namespace": "my.ine",
        "learning_paths": [],
        "has_published_parent": true
    },
    "session": null,
    "company": "a491bc32-c056-4946-9169-cc053387bada",
    "created": "2022-04-05T14:46:21.467210Z",
    "modified": "2024-04-30T14:34:56.115933Z",
    "is_beta": false,
    "lab_objectives": [],
    "main_learning_area": "3e1aa06f-2e9f-4789-b50d-aa027ad8dcfa",
    "learning_areas": [
        {
            "id": "3e1aa06f-2e9f-4789-b50d-aa027ad8dcfa",
            "name": "Cyber Security",
            "slug": "cyber-security"
        }
    ],
    "categories": [],
    "tags": [],
    "difficulty": null,
    "is_web_access": false,
    "is_lab_experience": false,
    "is_featured": false,
    "cve": null,
    "severity": null,
    "year": null,
    "classification": null,
    "external_url": "",
    "solution_video": null,
    "explanation_video": null,
    "description": "# Scenario\n\nYou are presented with some captured traffic from an internal network. Your job is to identify the various users and applications that were working in that network.\n\n# Goals\n\n-   Identify the network's users\n\n-   Identify protocols working within a network.\n\n# What you will learn\n\n-   How to use Wireshark to identify network activities.\n\n-   How to examine the headers and the payloads.\n\n-   Identifying and spotting different activities on the network.\n\n# Recommended tools\n\n-   Wireshark",
    "description_html": "<h1>Scenario</h1>\n<p>You are presented with some captured traffic from an internal network. Your job is to identify the various users and applications that were working in that network.</p>\n<h1>Goals</h1>\n<ul>\n<li>\n<p>Identify the network's users</p>\n</li>\n<li>\n<p>Identify protocols working within a network.</p>\n</li>\n</ul>\n<h1>What you will learn</h1>\n<ul>\n<li>\n<p>How to use Wireshark to identify network activities.</p>\n</li>\n<li>\n<p>How to examine the headers and the payloads.</p>\n</li>\n<li>\n<p>Identifying and spotting different activities on the network.</p>\n</li>\n</ul>\n<h1>Recommended tools</h1>\n<ul>\n<li>Wireshark</li>\n</ul>",
    "tasks": "# Tasks\n\n## Task 1: General Overview of the PCAP File\n\nTry to identify the various activities that took place in the network, during the period of time that this PCAP file includes. The provided PCAP file can be found at *Desktop/Module7/Lab18/full_final.pcapng*\n\n## Task 2: Follow the HTTP Traffic \n\nFocus on HTTP traffic only and try to answer the following questions:\n\n- Which was the first computer to issue an HTTP request?\n\n- What was the destination of this request?\n\n## Task 3: Check if you can extract user request-related information out of the PCAP file\n\nCan you identify what site made the user request, by analyzing the PCAP file? Can you also identify the DNS server's IP address, by analyzing the PCAP file?\n\n## Task 4: Identify the Port where the first HTTP Activity Occurred \n\nAnalyze the PCAP file and identify the first HTTP-related activity. Write down the source's and the destination's port regarding this HTTP activity and also write down the sequence number for both the server and the client.\n\n## Task 5: Isolate the DHCP Traffic and Analyze the Packets\n\nCan you identify what happened? What is the IP and the MAC address of the client? Was this a normal DORA procedure or something abnormal happened? Also, write down the ports that were used and the utilized transport layer protocol.\n\n## Task 6: Identify the Purpose of the ICMP Messages within the file\n\nWhich is the reason the ICMP messages within the PCAP were generated? Can you extract the IP addresses that were involved in those ICMP messages? What was the first packet's TTL?\n\n## Task 7: Spot any Abnormalities within the PCAP file\n\nThe ability to detect abnormal interactions within a pcap file is of paramount importance. Can you spot any other connection or data exchange other than the normal discovery protocols?",
    "tasks_html": "<h1>Tasks</h1>\n<h2>Task 1: General Overview of the PCAP File</h2>\n<p>Try to identify the various activities that took place in the network, during the period of time that this PCAP file includes. The provided PCAP file can be found at <em>Desktop/Module7/Lab18/full_final.pcapng</em></p>\n<h2>Task 2: Follow the HTTP Traffic</h2>\n<p>Focus on HTTP traffic only and try to answer the following questions:</p>\n<ul>\n<li>\n<p>Which was the first computer to issue an HTTP request?</p>\n</li>\n<li>\n<p>What was the destination of this request?</p>\n</li>\n</ul>\n<h2>Task 3: Check if you can extract user request-related information out of the PCAP file</h2>\n<p>Can you identify what site made the user request, by analyzing the PCAP file? Can you also identify the DNS server's IP address, by analyzing the PCAP file?</p>\n<h2>Task 4: Identify the Port where the first HTTP Activity Occurred</h2>\n<p>Analyze the PCAP file and identify the first HTTP-related activity. Write down the source's and the destination's port regarding this HTTP activity and also write down the sequence number for both the server and the client.</p>\n<h2>Task 5: Isolate the DHCP Traffic and Analyze the Packets</h2>\n<p>Can you identify what happened? What is the IP and the MAC address of the client? Was this a normal DORA procedure or something abnormal happened? Also, write down the ports that were used and the utilized transport layer protocol.</p>\n<h2>Task 6: Identify the Purpose of the ICMP Messages within the file</h2>\n<p>Which is the reason the ICMP messages within the PCAP were generated? Can you extract the IP addresses that were involved in those ICMP messages? What was the first packet's TTL?</p>\n<h2>Task 7: Spot any Abnormalities within the PCAP file</h2>\n<p>The ability to detect abnormal interactions within a pcap file is of paramount importance. Can you spot any other connection or data exchange other than the normal discovery protocols?</p>",
    "published_date": "2020-10-20T15:32:26Z",
    "solutions": "# Solutions\n\n## Task 1: General Overview of the PCAP File\n\nThe provided PCAP file can be found at **Desktop/Module7/Lab18/full_final.pcapng.**\n\nFirst, load this PCAP file into Wireshark.\n\nUsing the Wireshark protocol hierarchy option, we get a general overview of the protocols within the PCAP file.\n\n![1](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/1.png)\n\nLooking at the results, we can see that we have many well-known protocols such as DNS, DHCP, HTTP, and undefined protocol under the \"Data\" category.\n\n![2](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/2.png)\n\n## Task 2: Follow the HTTP Traffic \n\nWe can use the HTTP filter to only display the HTTP traffic.\n\n![3](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/3.png)\n\nAnd view the packet details from the windows below:\n\n![4](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/4.png)\n\nThe first HTTP packet came from 192.168.153.137 and was going to 212.58.244.68.\n\n## Task 3: Check if you can extract user request-related information out of the PCAP file\n\nUsually, HTTP traffic is preceded by a DNS query to get the IP address of the site the user has requested.\n\nWe can use *go back* in the PCAP file and look for the requests which occurred before the HTTP request.\n\nAlternatively, we can filter for the DNS traffic using the DNS filter, and choose the packet with the closest sequence number to the HTTP's first packet.\n\n![5](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/5.png)\n\nWe can see that the first HTTP packet has the sequence number 20.\n\nNow we need to examine the DNS traffic looking for the request that has occurred before this packet. \n\n![6](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/6.png)\n\nIt seems that the closest DNS packet to precede the HTTP traffic packet number 20, is the DNS packet number 15 which originated from the client 192.168.153.137.\n\n![7](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/7.png)\n\nThe client seems to ask about the [www.bbc.com](http://www.bbc.com) website and the server responded by sending the query with the appropriate response.\n\n![8](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/8.png)\n\n## Task 4: Identify the Port where the first HTTP Activity Occurred \n\nSince the question is asking about ports and sequence numbers, let's follow it on the TCP level.\n\nThe DNS packet sequence number is 15, and the first HTTP packet's number was 20. So we should expect to find the TCP handshake between 15 and 20.\n\nThe order of the events should be:\n\n1.  Sending the DNS query\n\n2.  Starting the TCP handshake\n\n3.  Sending the first HTTP request\n\n![9](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/9.png)\n\nLet's take a look at the first segment.\n\n![10](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/10.png)\n\nYou can see the source port 49385 which our browser used to send the SYN segment. And the webserver is -typically- using port 80.\n\nWe can also examine the flags within that segment.\n\n![11](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/11.png)\n\nLooking at that the sequence number, we see that Wireshark is telling us that the first segment has the sequence number 0 even though we know that it is supposed to be a random number.\n\nWireshark marks the first packet in a traffic flow starting from 0 to make it easier for the analyst to follow the stream.\n\n\n![12](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/12.png)\n\nIf we want to extract the actual sequence number, we need to go to the packet's hex dump in the window below.\n\nIf we translate the hex number below, we get the actual sequence number, which is 3070975449.\n\nNow, according to how TCP works, the server should acknowledge that segment with an ACK and its own sequence number.\n\n![13](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/13.png)\n\nHere we can see the server sending a segment with SYN and ACK flags as shown. \n\nThe server's sequence number is 971266888.\n\nAnd notice that the Server is sending the sequence number of the client's last received segment which is the b7 0b 5d da we saw earlier.\n\nThe final TCP segment sent by the client acknowledges the server's SYN segment.\n\n![14](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/14.png)\n\nThe Sequence number is b7 0b 5d da, which is the previous sequence number (b7 0b 5d d9) +1. The segment also has the server's last sequence number in the acknowledgment field (39 e4 5b 49).\n\n## Task 5: Isolate the DHCP Traffic and Analyze the Packets\n\nWe can use the bootp filter to display the DHCP filter, as follows.\n\n![15](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/15.png)\n\nIt seems that there are two DHCP cycles in the file. From the first look, we can see that a machine has requested an IP address, and another machine has released an IP address and re-requested an address.\n\nLet's analyze the first DHCP discover packet.\n\n![16](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/16.png)\n\nWe can see that the DHCP request is encapsulated within a UDP datagram.\n\nThe datagram originated from Port 68, and the server seems to be listening on Port 67.\n\nWe can see that this packet came from the device with the mac address specified in the figure. \n\n![17](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/17.png)\n\nAs mentioned earlier, we know that the DHCP process is usually initiated when the client sends a \"discover\" packet to the network.\n\nThis discover packet contains the IP address which the client wants to obtain from the server alongside the client's host name and mac address in the \"option\" section.\n\n![18](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/18.png)\n\nThe server replies with a DHCP offer packet containing the server's IP address and the client assigned IP address.\n\n![19](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/19.png)\n\nThe offer also contains the lease time, which is the time the client can keep the IP address. After the lease time is over the client can request to keep that IP address for another period. The offer also contains the network subnet mask, DNS server, network's name, and its default gateway.\n\n![20](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/20.png)\n\n## Task 6: Identify the Purpose of the ICMP Messages within the file\n\nJust like before we can filter the ICMP traffic using the ICMP filter in Wireshark\n\n![21](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/21.png)\n\nEven without an in-depth examination of the packet, Wireshark description tells us that it's a PC pinging another PC.\n\nBy examining the content of the ICMP packet, we can extract the source and destination IP address (192.168.153.130 is pinging 192.168.153.137) as well as the time to live which equals 128.\n\n![22](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/22.png)\n\n## Task 7: Spot any Abnormalities within the PCAP file\n\nSometimes in a big file of packets, some custom connections may go unnoticed.\n\nWhen working in network forensics, you'll often encounter applications that implement their own application-layer protocol.\n\nThat means Wireshark will only show them as typical TCP stream without being able to recognize what type of data is being encapsulated.\n\nRecall that the data section we saw in the protocol hierarchy window, we opened at the beginning of this lab under the TCP section.\n\nThis suggests that non-standard application data was exchanged over the network.\n\n![23](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/23.png)\n\nWe can investigate that mystery by looking at more statistics on the conversations within our file.\n\n![24](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/24.png)\n\nWe can examine the TCP conversation and order them in respect to the destination port by clicking the TCP and Port B tabs respectively.\n\n![25](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/25.png)\n\nWe can see that most of the connections we captured are going to either Port 80 or Port 443 which are normally used for HTTP and https connections.\n\nHowever, at the end of the file, we notice a connection going to a non-standard port which is 5555\n\n![26](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/26.png)\n\nWe can view the packets of that connection by filtering the packets that were going to or coming from port 5555.\n\nThe displayed packets show that after the TCP handshake there is a data exchange between the two communicating parties and then the connection is reset by the client who initiated.\n\nIn order to examine what sort of data was being exchanged between the communicating parties, we can use the **follow TCP stream** option to examine the data.\n\n![27](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/27.png)\n\nThe stream shows what seems to be a custom chat application being used between the two machines.\n\n![28](https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/28.png)",
    "solutions_html": "<h1>Solutions</h1>\n<h2>Task 1: General Overview of the PCAP File</h2>\n<p>The provided PCAP file can be found at <strong>Desktop/Module7/Lab18/full_final.pcapng.</strong></p>\n<p>First, load this PCAP file into Wireshark.</p>\n<p>Using the Wireshark protocol hierarchy option, we get a general overview of the protocols within the PCAP file.</p>\n<p><img alt=\"1\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/1.png\" /></p>\n<p>Looking at the results, we can see that we have many well-known protocols such as DNS, DHCP, HTTP, and undefined protocol under the \"Data\" category.</p>\n<p><img alt=\"2\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/2.png\" /></p>\n<h2>Task 2: Follow the HTTP Traffic</h2>\n<p>We can use the HTTP filter to only display the HTTP traffic.</p>\n<p><img alt=\"3\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/3.png\" /></p>\n<p>And view the packet details from the windows below:</p>\n<p><img alt=\"4\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/4.png\" /></p>\n<p>The first HTTP packet came from 192.168.153.137 and was going to 212.58.244.68.</p>\n<h2>Task 3: Check if you can extract user request-related information out of the PCAP file</h2>\n<p>Usually, HTTP traffic is preceded by a DNS query to get the IP address of the site the user has requested.</p>\n<p>We can use <em>go back</em> in the PCAP file and look for the requests which occurred before the HTTP request.</p>\n<p>Alternatively, we can filter for the DNS traffic using the DNS filter, and choose the packet with the closest sequence number to the HTTP's first packet.</p>\n<p><img alt=\"5\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/5.png\" /></p>\n<p>We can see that the first HTTP packet has the sequence number 20.</p>\n<p>Now we need to examine the DNS traffic looking for the request that has occurred before this packet. </p>\n<p><img alt=\"6\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/6.png\" /></p>\n<p>It seems that the closest DNS packet to precede the HTTP traffic packet number 20, is the DNS packet number 15 which originated from the client 192.168.153.137.</p>\n<p><img alt=\"7\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/7.png\" /></p>\n<p>The client seems to ask about the <a href=\"http://www.bbc.com\">www.bbc.com</a> website and the server responded by sending the query with the appropriate response.</p>\n<p><img alt=\"8\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/8.png\" /></p>\n<h2>Task 4: Identify the Port where the first HTTP Activity Occurred</h2>\n<p>Since the question is asking about ports and sequence numbers, let's follow it on the TCP level.</p>\n<p>The DNS packet sequence number is 15, and the first HTTP packet's number was 20. So we should expect to find the TCP handshake between 15 and 20.</p>\n<p>The order of the events should be:</p>\n<ol>\n<li>\n<p>Sending the DNS query</p>\n</li>\n<li>\n<p>Starting the TCP handshake</p>\n</li>\n<li>\n<p>Sending the first HTTP request</p>\n</li>\n</ol>\n<p><img alt=\"9\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/9.png\" /></p>\n<p>Let's take a look at the first segment.</p>\n<p><img alt=\"10\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/10.png\" /></p>\n<p>You can see the source port 49385 which our browser used to send the SYN segment. And the webserver is -typically- using port 80.</p>\n<p>We can also examine the flags within that segment.</p>\n<p><img alt=\"11\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/11.png\" /></p>\n<p>Looking at that the sequence number, we see that Wireshark is telling us that the first segment has the sequence number 0 even though we know that it is supposed to be a random number.</p>\n<p>Wireshark marks the first packet in a traffic flow starting from 0 to make it easier for the analyst to follow the stream.</p>\n<p><img alt=\"12\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/12.png\" /></p>\n<p>If we want to extract the actual sequence number, we need to go to the packet's hex dump in the window below.</p>\n<p>If we translate the hex number below, we get the actual sequence number, which is 3070975449.</p>\n<p>Now, according to how TCP works, the server should acknowledge that segment with an ACK and its own sequence number.</p>\n<p><img alt=\"13\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/13.png\" /></p>\n<p>Here we can see the server sending a segment with SYN and ACK flags as shown. </p>\n<p>The server's sequence number is 971266888.</p>\n<p>And notice that the Server is sending the sequence number of the client's last received segment which is the b7 0b 5d da we saw earlier.</p>\n<p>The final TCP segment sent by the client acknowledges the server's SYN segment.</p>\n<p><img alt=\"14\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/14.png\" /></p>\n<p>The Sequence number is b7 0b 5d da, which is the previous sequence number (b7 0b 5d d9) +1. The segment also has the server's last sequence number in the acknowledgment field (39 e4 5b 49).</p>\n<h2>Task 5: Isolate the DHCP Traffic and Analyze the Packets</h2>\n<p>We can use the bootp filter to display the DHCP filter, as follows.</p>\n<p><img alt=\"15\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/15.png\" /></p>\n<p>It seems that there are two DHCP cycles in the file. From the first look, we can see that a machine has requested an IP address, and another machine has released an IP address and re-requested an address.</p>\n<p>Let's analyze the first DHCP discover packet.</p>\n<p><img alt=\"16\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/16.png\" /></p>\n<p>We can see that the DHCP request is encapsulated within a UDP datagram.</p>\n<p>The datagram originated from Port 68, and the server seems to be listening on Port 67.</p>\n<p>We can see that this packet came from the device with the mac address specified in the figure. </p>\n<p><img alt=\"17\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/17.png\" /></p>\n<p>As mentioned earlier, we know that the DHCP process is usually initiated when the client sends a \"discover\" packet to the network.</p>\n<p>This discover packet contains the IP address which the client wants to obtain from the server alongside the client's host name and mac address in the \"option\" section.</p>\n<p><img alt=\"18\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/18.png\" /></p>\n<p>The server replies with a DHCP offer packet containing the server's IP address and the client assigned IP address.</p>\n<p><img alt=\"19\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/19.png\" /></p>\n<p>The offer also contains the lease time, which is the time the client can keep the IP address. After the lease time is over the client can request to keep that IP address for another period. The offer also contains the network subnet mask, DNS server, network's name, and its default gateway.</p>\n<p><img alt=\"20\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/20.png\" /></p>\n<h2>Task 6: Identify the Purpose of the ICMP Messages within the file</h2>\n<p>Just like before we can filter the ICMP traffic using the ICMP filter in Wireshark</p>\n<p><img alt=\"21\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/21.png\" /></p>\n<p>Even without an in-depth examination of the packet, Wireshark description tells us that it's a PC pinging another PC.</p>\n<p>By examining the content of the ICMP packet, we can extract the source and destination IP address (192.168.153.130 is pinging 192.168.153.137) as well as the time to live which equals 128.</p>\n<p><img alt=\"22\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/22.png\" /></p>\n<h2>Task 7: Spot any Abnormalities within the PCAP file</h2>\n<p>Sometimes in a big file of packets, some custom connections may go unnoticed.</p>\n<p>When working in network forensics, you'll often encounter applications that implement their own application-layer protocol.</p>\n<p>That means Wireshark will only show them as typical TCP stream without being able to recognize what type of data is being encapsulated.</p>\n<p>Recall that the data section we saw in the protocol hierarchy window, we opened at the beginning of this lab under the TCP section.</p>\n<p>This suggests that non-standard application data was exchanged over the network.</p>\n<p><img alt=\"23\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/23.png\" /></p>\n<p>We can investigate that mystery by looking at more statistics on the conversations within our file.</p>\n<p><img alt=\"24\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/24.png\" /></p>\n<p>We can examine the TCP conversation and order them in respect to the destination port by clicking the TCP and Port B tabs respectively.</p>\n<p><img alt=\"25\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/25.png\" /></p>\n<p>We can see that most of the connections we captured are going to either Port 80 or Port 443 which are normally used for HTTP and https connections.</p>\n<p>However, at the end of the file, we notice a connection going to a non-standard port which is 5555</p>\n<p><img alt=\"26\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/26.png\" /></p>\n<p>We can view the packets of that connection by filtering the packets that were going to or coming from port 5555.</p>\n<p>The displayed packets show that after the TCP handshake there is a data exchange between the two communicating parties and then the connection is reset by the client who initiated.</p>\n<p>In order to examine what sort of data was being exchanged between the communicating parties, we can use the <strong>follow TCP stream</strong> option to examine the data.</p>\n<p><img alt=\"27\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/27.png\" /></p>\n<p>The stream shows what seems to be a custom chat application being used between the two machines.</p>\n<p><img alt=\"28\" src=\"https://assets.ine.com/content/ptp/lab_18_traffic_analysis_using_wireshark_part_1/28.png\" /></p>",
    "flags": [],
    "min_points_to_pass": null,
    "access_type": "default",
    "user_status": "unstarted",
    "user_lab_status": null,
    "user_status_modified": null,
    "user_flags": [],
    "global_running_session": null
}