Wireshark/LLMNR
Wireshark is a free and open source packet analyzer used for network troubleshooting and analysis. These activities will show you how to use Wireshark to capture and analyze Link-Local Multicast Name Resolution (LLMNR) traffic.
Readings
[edit | edit source]Preparation
[edit | edit source]To prepare for this activity:
- Start Windows.
- Log in if necessary.
- Install Wireshark.
Activity 1 - Capture LLMNR Traffic
[edit | edit source]To capture LLMNR traffic:
- Start a Wireshark capture.
- Open a command prompt.
- Type ping <unknown>, where <unknown> is any unknown host name on your network. An unknown host name is used for this activity because names resolved by DNS will not generate LLMNR traffic.
- Close the command prompt.
- Stop the Wireshark capture.
Activity 2 - Analyze LLMNR IPv6 Traffic
[edit | edit source]To analyze LLMNR IPv6 traffic:
- Observe the traffic captured in the top Wireshark packet list pane. To view only LLMNR traffic, type udp.port == 5355 (lower case) in the Filter box and press Enter.
- Select the first LLMNR packet labeled Standard query.
- Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 6 / User Datagram Protocol / Link-local Multicast Name Resolution (query) frame.
- Expand Ethernet II to view Ethernet details.
- Observe the Destination and Source fields. The destination should be the LLMNR IPv6 multicast MAC address 33:33:00:01:00:03 and the source should be your MAC address. You can use ipconfig /all and netsh interface ipv6 show neighbors to confirm.
- Expand Internet Protocol Version 6 to view IPv6 details.
- Observe the Source address. Notice that the source address is your link-local IPv6 address.
- Observe the Destination address. Notice that the destination address is the LLMNR multicast IPv6 address ff02::1:3.
- Expand User Datagram Protocol to view UDP details.
- Observe the Source port. Notice that it is a dynamic port selected for this LLMNR query.
- Observe the Destination port. Notice that it is llmnr (5355).
- Expand Link-local Multicast Name Resolution (query) to view LLMNR details.
- Expand Flags to view flags details.
- Expand Queries to view query details.
- Observe the query generated.
Activity 3 - Analyze LLMNR IPv4 Traffic
[edit | edit source]To analyze LLMNR IPv4 traffic:
- Observe the traffic captured in the top Wireshark packet list pane. To view only LLMNR traffic, type udp.port == 5355 (lower case) in the Filter box and press Enter.
- Select the second LLMNR packet labeled Standard query.
- Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 4 / User Datagram Protocol / Link-local Multicast Name Resolution (query) frame.
- Expand Ethernet II to view Ethernet details.
- Observe the Destination and Source fields. The destination should be the LLMNR IPv4 multicast MAC address 01:00:5e:00:00:fc and the source should be your MAC address. You can use ipconfig /all and arp -a to confirm.
- Expand Internet Protocol Version 4 to view IPv4 details.
- Observe the Source address. Notice that the source address is your IPv4 address.
- Observe the Destination address. Notice that the destination address is the LLMNR multicast IPv4 address 224.0.0.252.
- Expand User Datagram Protocol to view UDP details.
- Observe the Source port. Notice that it is a dynamic port selected for this LLMNR query.
- Observe the Destination port. Notice that it is llmnr (5355).
- Expand Link-local Multicast Name Resolution (query) to view LLMNR details.
- Expand Flags to view flags details.
- Expand Queries to view query details.
- Observe the query generated.
- Close Wireshark to complete this activity. Quit without Saving to discard the captured traffic.