Week 7 Assignment - DNS, IP, and TCP Traffic Streams

Coursework Instructions:

Preparation Download and install the TCP/IP packet capture program https://www(dot)wireshark(dot)org/ Decide on a website of your choice for which you will capture and analyze TCP/IP traffic streams and identify the URL of your selected website (e.g., https://www(dot)ibm(dot)com).  Use the Week 7 Assignment Template Download Week 7 Assignment Templateto complete and upload your work to the course room. Resources Wireshark DocumentationLinks to an external site.. Wireshark Frequently Asked QuestionsLinks to an external site.. Wireshark User's Guide - Chapter 2: Building and Installing WiresharkLinks to an external site.. Wireshark Essential TrainingLinks to an external site.. Overview Each protocol in the TCP/IP stack uses a specialized packet to transmit and receive data and protocol-specific information at its layer of the protocol stack. For example, there is the TCP segment packet at the TCP layer and there is the IP datagram packet at the IP layer that encapsulates or includes the TCP segment as its data. Packet capture programs like Wireshark allow us to capture these TCP/IP packets as frames from a network interface card that is connected to the Internet. More importantly, these packet capture programs enable us to analyze TCP/IP traffic and examine the networking information therein. In this assignment, you will use Wireshark to capture and analyze the DNS, IP, and TCP packets of the traffic streams associated with browsing a website of your choice. You will document your capture and analysis with screenshots highlighting the key information analyzed. You will also explain what you did, interpret the result of your analysis, and reflect on this learning experience in a one-page written summary. Instructions Start the TCP/IP packet capture program WiresharkLinks to an external site.. Configure Wireshark Time Display Format to display time as "Date and Time of Day" as follows: View > Time Display Format > Date and Time of Day Do not use the default configuration of Time Display Format as "Seconds Since the Beginning of Capture." Start Wireshark Capture on your network interface that is connected to the Internet. In a web browser window, type in the URL of your chosen website and hit ENTER to access the website. Stop Wireshark Capture after a few seconds. Analyze the Wireshark frame that encapsulates the DNS query about your chosen URL to identify: The IP address of your network interface as the source IP address. The URL of your chosen website. The DNS Queries part of the frame. Screenshot your identified frame, similar to figure 1.a, below. On the screenshot, highlight the IP address of your network interface as the source IP address, the URL of your chosen website, and the DNS Queries part of the frame. Figure 1.a. A Wireshark window is shown. The line containing the IP address of the network interface is highlighted in red with a note stating “Time displayed as Date and Time of Day.” Queries section of the window is also highlighted, including the following text under the Queries heading: www(dot)ibm(dot)com: type A, class IN. Analyze the Wireshark frame that encapsulates the DNS response to the query about your chosen URL to identify: The IP address of your network interface as the destination IP address. The URL of your chosen website. The DNS Answers part of the frame. Screenshot your identified frame, similar to Figure 1.b, below. On the screenshot, highlight the IP address of your network interface as the destination IP address, the URL of your chosen website, and the DNS Answers part of the frame. Figure 1.b A Wireshark window is shown. The line containing the IP address of the network interface is highlighted, as is the Answers area of the window, which appears below the previously described Queries area. Analyze the Wireshark frame that encapsulates the TCP handshake's first SYN TCP segment from your network interface to your chosen URL to identify: The header checksum in the IP packet. The source IP address, the destination IP address in the IP packet. The source port number and the destination port number in the TCP packet. Screenshot your identified frame, similar to figure 2.a below. On the n screenshot, highlight the header checksum, the source IP address, and the destination IP address in the IP packet. Clearly highlight on the screenshot the source port number and the destination port number in the TCP packet. Figure 2.a. A Wireshark window is shown with the following sections highlighted, moving down from the top of the page: The line containing the IP address of the network interface, the header checksum, the source and destination addresses, and the source and destination ports. Analyze the Wireshark frame that encapsulates the TCP handshake's SYN, ACK TCP segment from your chosen URL to your network interface to identify: The header checksum in the IP packet. The source IP address, the destination IP address in the IP packet. The source port number and the destination port number in the TCP packet. Screenshot your identified frame, similar to that shown in Figure 2.b below. On the screenshot, highlight the header checksum, the source IP address, and the destination IP address in the IP packet. Clearly highlight on the screenshot the source port number and the destination port number in the TCP packet. Figure 2.b. A Wireshark window is shown with the following sections highlighted, moving down from the top of the page: The source IP address, the header checksum, the source and destination addresses, and the source and destination ports. Analyze the Wireshark frame that encapsulates the TCP handshake's last ACK TCP segment from your chosen URL to your network interface to identify: The header checksum in the IP packet. The source IP address, the destination IP address in the IP packet. The source port number and the destination port number in the TCP packet. Screenshot your identified frame, similar to that shown in Figure 2.c below. On the screenshot, highlight the header checksum, the source IP address, and the destination IP address in the IP packet. Clearly highlight on the screenshot the source port number and the destination port number in the TCP packet. Figure 2.c. A Wireshark window is shown with the following sections highlighted, moving down from the top of the page: The source IP address, the header checksum, the source and destination addresses, and the source and destination ports. Use the Week 7 Assignment Template to submit the following: The screenshots you took. The screenshots should be labeled, in the same order as these instructions, and highlighted to identify the requested analysis information. Write at least 1 page on each of the following for a 3 - 5 page summary: Explaining the overall process. Interpreting your analysis results. Reflecting on your learning experience. The specific course learning outcome associated with this assignment is: Analyze TCP/IP traffic packets to interpret key protocol information.

Coursework Sample Content Preview:

Analysis of TCP/IP Traffic Using Wireshark Name Institution affiliation Course Instructor Date Analysis of TCP/IP Traffic Using Wireshark Introduction Modern internet communications depend on the basic technology known as Transmission Control Protocol/Internet Protocol (TCP/IP). TCP/IP functions as the primary data transmission component responsible for fast information exchange between network devices. According to (Hunt, 2002a) Multiple layers form the TCP/IP model which assigns specific functions related to network traffic processing to each layer. A system of four layers called Application, Transport, Internet and Network Interface collaborate to create an effective communication process. (Raj et al., 2024) studies support that, the exchange of data relies on a critical contribution from every protocol represented at the TCP/IP stack level. Network traffic uses IP (Internet Protocol) for packet addressing and routing at the Internet layer before the Transport layer validates reliable communication with TCP (Transmission Control Protocol). TCP segments control data transmission by keeping packets in order and sending them twice for accurate delivery to their targets. Through the Application layer end-users can perform various services which encompass web browsing as well as email and file transfers. Network performance optimization and the detection of connectivity problems together with cybersecurity enhancement require orderly examination of packet structures and network traffic understanding, this is well supported by (ABU & Nath, 2024). Real-time network packet monitoring and analysis along with interpretation occurs through the robust capabilities of Wireshark packet capture tools. Through Wireshark users get access to multiple protocol layer inspection which combines with packet detail displays and/or network activity pattern detection capabilities. Network users can obtain critical knowledge about communication protocols through packet analysis during different transmission periods. The document delivers an in-depth direct analysis of TCP/IP traffic by using Wireshark. The analysis goal focuses on the examination of packets used for website access. We will examine the DNS communications and subsequent TCP handshakes during the process which establish client-to-server connections. Examining these packets will lead to better comprehension of data transmission methods present in internet communications and protocol layer collaboration for effective data exchange. Analysis of TCP/IP Traffic When going through the analysis we collected website traffic and studied multiple communication protocols between different devices. The following portion includes important findings extracted from recorded packets. 1. DNS Query and Response (Kozierok, 2005) agrees that; a web browser requires domain name resolution to IP address into an operational process when users submit URLs. The system requires users to access a Domain Name System (DNS) server to complete this process. In the captured packets: The client delivered a DNS request which asked for the IP address that links to the domain name. The DNS server answered with the necessary IP address that enabled connection establishment for the client. A web browsing system depends on this necessary step to transform easy-to-read domain names into the computer-readable IP addresses needed for network routing and communication. 2. TCP Handshake A reliable TCP connection emerges from a three-way handshake which begins prior to the data transmission process. The network traffic revealed the specified order of packets as shown: * The client begins the connection process with the server through the SYN command. * The server acknowledges the request through SYN-ACK (Synchronize-Acknowledge) to start the connection setup process. * A confirmation from the client through the ACK signal leads to connection establishment after the handshake. Such handshake confirms data exchange readiness between devices to protect transmitted data from loss and maintain dependable communication. 3. HTTP Request and Response Following TCP handshake completion, the client issued a HTTP request to obtain the webpage content from the server. The analysis showed: * An HTML file transfer took place when the client used an HTTP GET request. * Once the HTML page arrived at the server it distributed further packets that included webpage elements such as images and scripts among others. * Webpages assemble through multiple HTTP requests that separately request different web reso...

Updated on June 16, 2025

Get the Whole Paper!

Not exactly what you need?

Do you need a custom essay? Order right now:

Order

👀 Other Visitors are Viewing These APA Essay Samples:

Week 10 Assignment - Technical Paper: Proof of Concept (POC)

4 pages/≈1100 words | 2 Sources | APA | IT & Computer Science | Coursework |
Assignment 2: Unsupervised Learning

2 pages/≈550 words | 3 Sources | APA | IT & Computer Science | Coursework |
Cybersecurity

1 page/≈275 words | No Sources | APA | IT & Computer Science | Coursework |