Lab 3 2

Summary:

In this lab we used the Wireshark tool, and pinged another VM in our Proxmox environment. To investigate how ping requests work on a packet level.

I ran into no problems while completing the lab

Summary of understanding:

• ARP uses Mac addresses to know which device is on which ip address on the LAN. It does this by using the broadcast address to ask who an IP address is, and then getting a response where it gets told which mac address is on that ip address.
• You can use Wireshark to capture network packets, and investigate them.

I. Analyze Traffic to a Remote Network (different LAN)

1. Open a Command Prompt (windows) or Terminal (Linux)
2. Open Wireshark and start a capture
3. Back in the Command Prompt/Terminal- ping the Google Public DNS server (8.8.8.8)
4. Stop Capture
5. Deliverable 1: Analyze the ICMP Response from Google:
   • Answer:
     • Source: bc:24:11:af:e5:65
     • Destination: bc:24:11:44:b7:c4
   • Answer**:** Does the source MAC address look familiar from prior labs? Do you think it is the Google Server's MAC address?**
     • It is the default gateway's mac address

II. Examine both sides of a ping

6. Find a partner in class and get their IP address.
7. From your workstation, ping your partner's IP and make sure you get a response
8. On your workstation, start a Wireshark capture, ping your partner's IP, and stop the capture
9. On your workstation, analyze the capture
   • Deliverable 2: What are the source and destination MACs in the ping reply?
     • Source: bc:24:11:d4:5b:dc
     • Destination: bc:24:11:af:e5:65
10. What is your partner's MAC address?
    • Deliverable 3: Does the MAC address match the address from you traffic capture? If not - what do you think happened?
      • Yes

        

III:  Capture both sides of the ping request

1. Start a Wireshark capture on both PCs and let it run
2. From a command prompt on your workstation, ping your partner's IP address
3. Stop the captures on both Workstations
4. Find and compare the ICMP traffic on both devices
5. Deliverable 4:
   1. On your workstation**,** what is the source and destination MACs from the pings?
      1. Source: bc:24:11:af:e5:65
      2. Destination: bc:24:11:d4:5b:dc
   2. On your partner's workstation**,** what is the source and destination MACs from the pings?
      1. Source: bc:24:11:af:e5:65
      2. Destination: bc:24:11:d4:5b:dc
6. Deliverable5:  Why do you think they are different OR THE SAME?
   1. They are the same because it is the same ping, it is the same half there is no reason for it to be different.