Assignment:
By gaining an understanding of the basic protocol analyzer (Wireshark), students will be able to set up and read basic digital traffic, to include:
- Gaining a foundational understanding of logging.
- Identifying source and destination IPs.
- Translating IP addresses into websites.
- Identifying ports and protocols.
- Creating a timeline of events.
Part 1:
In this lab, you will understand basic Wireshark usage and Linux commands. Complete the following:
View the "Basic Wireshark Lab" video, located in the Class Resources.
Provide screenshots of Wireshark with SRC port and DST port on the UI, your ping sweep, your services scan against your Windows 7 system, the index webpage of your Kali Box, the pictures directory of the Kali webserver, and the Wireshark following the HTTP stream.
Part 2:
Write a 250 to 500 word lab report and include a title page, table of contents, overview, and summary. Include the following in the summary:
Your Kali IP address.
The Windows IP Address.
The command used to change directory.
The command that moves a file.
The command that creates a new directory.
The version of Apache that is running according to Wireshark.
An explanation for why a timestamp is important on Wireshark, as well as other logging tools.
A list of 10 well-known ports and associated protocols.
A brief explanation of the difference between a port and a protocol.
An explanation for when using Wireshark would be beneficial. Provide two other uses besides the one mentioned in the video.
The indicators one might see within Wireshark or another analyzer tool that may indicate a current or past attack.
While APA style is not required for the body of this assignment, solid academic writing is expected, and documentation of sources should be presented using APA formatting guidelines, which can be found in the APA Style Guide.