The wireshark interface is divided into three horizontal columns and each of the windowpanes have different functionality. The first pane demonstrates the details of the packets captured on the network and the second pane shows the details of the captured packet that is selected in the first pane. The third pane consists of the packet byte and it shows the raw data of the packet content.

The frame 3 helwet brand of computer launched the scan and its IP address was 138.77.216.88

The information was found on the Ethernet II section of the packet details pane in wireshark. The details of the IP address was found by expanding the section.

For the packet bytes captured in the frame 4 to 6 a hello message is sent from the server for connecting with the client which is requesting to connect. The version of the protocol, cipher suite, method of compression, certificate request and the session ID is sent to the client. The next frame the certificate is verified and in the frame 6 the “hello message done” is sent for completing the verification process.

The network administrator can utilize wireshark for troubleshooting the following problems such as:

• Monitoring the data flow in the network for the prevention of the distributed denial of service attacks
• Resolving the name resolution problems in the network and adjust the network settings for handling large queries. .5 mark each item, total 2 for 3a.

Proto Column – It is used for showing the list of the TCP or UDP sockets and the network protocols used for data communication in the network. Proto stands for protocol and the next column local address which shows the connection between the hosts and the sockets. The physical address of the Pc is used for the netstat. The foreign IP address shows the address of the foreign PC connected remotely in the network. The, ”State Column” shows the state of the socket in list and the PID shows the owner of the process and the user using the program.

LISTENING – It implies that the PC is waiting for outer PC and for establishing a connection between them.

ESTABLISHED – it shows that the Pc is ready for sending and receiving data packets in the network

CLOSED_WAIT – It implies that the external PC and the remote client has closed the connection and the address table of the router and the other PC’s is not updated. 1

The command “tracert www.google.com” is used for traceroute the path used by the local host connected in the network to reach the host address google.com. From the above screenshot it can be demonstrated that 9 network devices are used and it includes the router with IP address 10.10.30.1 and the other devices to reach the target “google.com” having the public IP address 172.217.163.132. 1

References

Bhatia, R., Hao, F., Kodialam, M. and Lakshman, T.V., 2015, April. Optimized network traffic engineering using segment routing. In Computer Communications (INFOCOM), 2015 IEEE Conference on (pp. 657-665). IEEE.

Carpa, R., Glück, O. and Lefevre, L., 2014, December. Segment routing based traffic engineering for energy efficient backbone networks. In Advanced Networks and Telecommuncations Systems (ANTS), 2014 IEEE International Conference on (pp. 1-6). IEEE.

Davoli, L., Veltri, L., Ventre, P.L., Siracusano, G. and Salsano, S., 2015, September. Traffic engineering with segment routing: SDN-based architectural design and open source implementation. In Software Defined Networks (EWSDN), 2015 Fourth European Workshop on (pp. 111-112). IEEE.

Lazzeri, F., Bruno, G., Nijhof, J., Giorgetti, A. and Castoldi, P., 2015, May. Efficient label encoding in segment-routing enabled optical networks. In Optical Network Design and Modeling (ONDM), 2015 International Conference on (pp. 34-38). IEEE

Medhi, D. and Ramasamy, K., 2017. Network routing: algorithms, protocols, and architectures. Morgan Kaufmann.