Wireshark/HTTP

Wireshark is a free and open source packet analyzer used for network troubleshooting and analysis. These activities will show you how to use Wireshark to capture and analyze HTTP (Hypertext Transfer Protocol) traffic.

Preparation

To prepare for this activity:

Start Windows.
Log in if necessary.
Install Wireshark.

Activity 1 - Capture HTTP Traffic

To capture HTTP traffic:

Open a new web browser window or tab.
Search the Internet for an http (rather than https) website.
Start a Wireshark capture.
Navigate to the website found in your search.
Stop the Wireshark capture.

Activity 2 - Select Destination Traffic

To select destination traffic:

Observe the traffic captured in the top Wireshark packet list pane. To view only HTTP traffic, type http (lower case) in the Filter box and press Enter.
Select the first HTTP packet labeled GET /.
Observe the destination IP address.
To view all related traffic for this connection, change the filter to ip.addr == <destination>, where <destination> is the destination address of the HTTP packet.

Activity 3 - Analyze TCP Connection Traffic

To analyze TCP connection traffic:

Observe the traffic captured in the top Wireshark packet list pane. The first three packets (TCP SYN, TCP SYN/ACK, TCP ACK) are the TCP three way handshake. Select the first packet.
Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 4 / Transmission Control Protocol frame.
Expand Ethernet II to view Ethernet details.
Observe the Destination and Source fields. The destination should be your default gateway's MAC address and the source should be your MAC address. You can use ipconfig /all and arp -a to confirm.
Expand Internet Protocol Version 4 to view IP details.
Observe the Source address. Notice that the source address is your IP address.
Observe the Destination address. Notice that the destination address is the IP address of the HTTP server.
Expand Transmission Control Protocol to view TCP details.
Observe the Source port. Notice that it is a dynamic port selected for this HTTP connection.
Observe the Destination port. Notice that it is http (80). Note that all of the packets for this connection will have matching MAC addresses, IP addresses, and port numbers.

Activity 4 - Analyze HTTP Request Traffic

To analyze HTTP request traffic:

Observe the traffic captured in the top Wireshark packet list pane.
Select the fourth packet, which is the first HTTP packet and labeled GET /.
Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 4 / Transmission Control Protocol / Hypertext Transfer Protocol frame. Also notice that the Ethernet II, Internet Protocol Version 4, and Transmission Control Protocol values are consistent with the TCP connection analyzed in Activity 3.
Expand Hypertext Transfer Protocol to view HTTP details.
Observe the GET request, Host, Connection, User-Agent, Referrer, Accept, and Cookie fields. This is the information passed to the HTTP server with the GET request.
Observe the traffic captured in the top Wireshark packet list pane.
Select the fifth packet, labeled TCP ACK. This is the server TCP acknowledgement of receiving the GET request.

Activity 5 - Analyze HTTP Response Traffic

To analyze HTTP response traffic:

Observe the traffic captured in the top Wireshark packet list pane.
Select the second HTTP packet, labeled 301 Moved Permanently.
Observe the packet details in the middle Wireshark packet details pane.
Expand Hypertext Transfer Protocol to view HTTP details.
Observe the HTTP response, Server, Expires, Location, and other available information. This response indicates that the requested page has permanently moved to the location provided.
Observe the traffic captured in the top Wireshark packet list pane.
Select the next packet, labeled TCP ACK. This is the client TCP acknowledgement of receiving the HTTP response.

Activity 6 - Analyze HTTP Request Traffic

To analyze HTTP request traffic:

Observe the traffic captured in the top Wireshark packet list pane.
Select the third HTTP packet, labeled GET /wiki/Wikiversity:Main_Page.
Observe the packet details in the middle Wireshark packet details pane.
Expand Hypertext Transfer Protocol to view HTTP details.
Observe the HTTP request fields. Notice that the request is similar to the request in Activity 4 above, except that the new page location is requested.
Observe the traffic captured in the top Wireshark packet list pane.
Select the next packet, labeled TCP ACK. This is the server TCP acknowledgement of receiving the GET request.

Activity 7 - Analyze HTTP Response Traffic

To play HTTP response traffic:

Observe the traffic captured in the top Wireshark packet list pane.
Select the next packet, labeled TCP segment of a reassembled PDU. Notice that because the server response is longer than the maximum segment PDU size, the response has been split into several TCP segments.
Observe the packet details in the middle Wireshark packet details pane.
Observe the packet contents in the bottom Wireshark packet bytes pane.
Observe the traffic captured in the top Wireshark packet list pane. Notice that for every two TCP segments of data, there is a TCP ACK acknowledgement of receiving the HTTP response.
Select the last HTTP packet, labeled HTTP 200 OK.
Observe the packet details in the middle Wireshark packet details pane. Notice the Reassembled TCP Segments listed.
Expand Hypertext Transfer Protocol to view HTTP details.
Observe the full HTTP response to be passed to the web browser.
Expand Line-based text data to observe web page content.
In the web browser, right-click on the web page and view the page source. Notice that it is identical to the line-based text captured in Wireshark.
Close the web browser.
Close Wireshark to complete this activity. Quit without Saving to discard the captured traffic.

References