DEMO: IPv4 Header

Capturing the Traffic

We're going to take a look and see what the IP header looks like within Wireshark. So what I have to do is monitor one of my network connections within Wireshark. I'm going to monitor the Wi-Fi connection, because that's what has the most traffic going across it. Then I want to generate traffic to a specific site, and then we're going to take a look at what that traffic looks like.

I'm going to start by monitoring the Wi-Fi. I'm going to bring up a browser, and we might as well take a look at the IP header. I want to take a look at a Wikipedia article, so I'm going to type in wiki. The first thing that comes up is IP version 4 in Wikipedia, so I'll click on that. Now it's loaded that page, or it's downloaded that page from the internet onto my computer, and I can view it.

Now let's take a look at what that looks like in Wireshark. I'm going to pull up Wireshark and stop the capture. We've got a lot of packets that are captured here. On the left-hand side, the very first column that we get across shows that I have 2,816 packets captured. So just in that short period of time that I was monitoring the traffic going across this network card, I've got more than 2800 packets that I've captured.

I don't need all of that. A lot of that is just noise, just a lot of extra information. What we really want to narrow down is the traffic that came between this computer right here and Wikipedia. So I'm going to go in there and start searching for those packets.

Finding the IP Address in DNS

I'm going to create a filter that will actually narrow it down to just those packets. But to do that, what I'm going to do in this case is filter off the IP address. But I need to know the IP address. When I clicked the link on Google to actually go to the Wikipedia site, the first thing that happened is it went to wikipedia.org, and so it needs to do a DNS resolution to find out what the IP address is. So I can look at the DNS records that came across this network interface to find what the answer was. What was the IP address of wikipedia.org?

Here I am in Wireshark. I'm going to do a search off of the protocol here and look for DNS. The first thing I'm just going to do is a sort right here, and I do a sort for this protocol column just by clicking that column, and it's going to sort it. I'm going to scroll all the way up to the top. It starts with the ARP requests here. The next in line is the DNS, so I'm going to scroll down until I see a DNS record, or DNS request, that went out for Wikipedia. So I see here wikipedia.org. So it is 1,863 packet. That is a DNS request, so I'm going to click on it.

So that's the request that goes out, which doesn't have the answer that I'm looking for. But you can see on the left-hand side it shows that this 1,863rd packet went out, but the response coming back in is 1,880. So I'm going to click that one right here, and I can search now what the response was. You see the domain name system response down here in the middle section of Wireshark, so I'm going to open that up. As I scroll through here, it's going to give me some information that was sent back to this device. What I'm actually looking for is the answers. The query right here of what was sent out is, who is wikipedia.org? And then the answer is the IP address associated with wikipedia.org. Now I have an IP address that I can form my filter off of.

Building a Display Filter

The next thing we're going to do is create a filter that gets rid of all of the other IP addresses, all of the other information that's flowing across this network interface card. It's only going to be left with the information that was flowing from this machine to wikipedia.org.

Right here is the line where we create the filter at, and I'd be able to type in what's called an expression to be able to filter it down to what exactly I'm looking for. Now, how do I write an expression? Well, one way is, if I want to know what expressions I can write, I can go to the web and browse it and find out that information. Within Wireshark it actually gives us some capability of doing that. I'm going to take a look at this Analyze right here, and they have display filters. If I click on here, it'll actually show me some of the display filters. And the one we want to actually filter off of is right here: IPv4 address 192. Well, it's not that address, but it is an address similar to that. So this is one location where I can get some help and figure out what expression I want to write.

But if I want to, I can also use this display filter expressions, and it gives me a little wizard that I can step through to create my expression. As I scroll through here, you can see there are tons of expressions that I can create. These little arrows or greater-than signs on the left-hand side are actually drop-downs, so for quite a few of these there's actually even more expressions after this. I was scrolling through here and you can see there are just a ton of different ones out there. So it is helpful to have a basic understanding of what you want to sort by. There is this search right here that I could type in something like IPv4 in order to jump to certain areas and filter it out.

The one that I saw is the IP, so I'm going to go to IPv4. I'm going to scroll down to that section of it. Here we are. I'm going to open that up, and within here it says ip.addr, address source or destination. So it's either the source or the destination. I like this, because then I can see the requests that are coming through and the responses to it, or the acknowledgements. So I'm going to say yes, I want to sort on that. I can say is it present, which means just if it exists then it will show, or I can say equals this, and that's a double equal sign, or it does not equal this. So I can filter, I can say I want to see everything except for the IP address that I'm going to. So I actually want equal in this case right here, so I'm going to hit the double equal sign.

And then the value I'm going to use is going to be 19835.26 96. If you notice, at the bottom before I typed in that 96 it's actually red, so a color is showing me that this is actually not valid. It has a little message here that says it's not... It turns green. That means that it recognizes it as an expression. I can do okay to do this search and press the arrow to filter it out. And now I'm just seeing the information that's going between my computer, which is 192.168.42.45, and wikipedia.org, which is 198.35.26.96, and it's going both directions there.

Reading the IPv4 Header

I'm going to scroll down. This first view is just creating a connection between the two, so we see that it creates this connection back and forth. I'm going to get one of the larger downloads of information here, so I'm looking at the length of the packet size right here, and just going to click on one of the larger ones right here. And now we're able to look and view inside of this packet.

Now, recall we've already gone over what the IP header looks like. This was the slide I used. I also brought up the Wikipedia site. You can do the same thing; I recommend pulling that up as we go through here so you can see the correlation of what it looks like on here and what it looks like when we dig into the actual Wireshark and see the data that actually came across here.

One thing I'll just point out, because we're going to take a look at this, is that the IHL right here, or the internet header length, we're going to see in a second that it's five, which means there's five lines. We can see this is the first line right here, then the second line, then the third line, fourth line, and fifth line. And there is no options when you have five lines. There's no options that are set here. So we'll see all that as we look through Wireshark and see what data is coming across there.

Now that we've narrowed down to the packets that we want to take a look at, and we've chosen the specific packet that we want to look at, what we can do is take a look at what that header looks like. Here we can see the header of the Ethernet frame. Here's a section where it shows the layer three or the IP header here, which is what we're going to look at in a second. Or we can see what's within the layer 4 header here, which is the TCP protocol. So we're going to actually take a look at the internet protocol and take a look at what the header looks like for that.

I'm going to click the little greater-than sign or the arrow sign here to drop it down and show an expanded list of everything we have. As we go through here, once again, if you have that table up of what an IP header looks like, you'll see that it lines up. First of all, we've got the version. So this is IP version 4, so it is showing IP version 4. It even shows the bits over here, 0 1 0 0, so that is the binary equivalent of four. So we see that that lines up with the version.

What it's showing down here at the bottom is the part of the packet. When you click up here it will show you the part of the packet down here in hexadecimal. So I click this right here and it's showing a hexadecimal form of this, which is 45 right there. Or I could actually show this as bits. You'll see when I click this, the highlighted section down here shows the first four bits as 0 1 0 0. So this is showing the first four bits up here and it's showing it down in the section down below, 0 1 0 0. The second four bits is 0 1 0 1, so we look up here and that is right here, 0 1 0 1. And that is saying that there is five lines.

Now, that's what I pointed out when we see the visual showing of the internet packet header. Then we see that there is five lines in there, and since there is four bytes per line, then we have a total of 20 bytes that is going to be the header length of this. So it's 20 bytes long. To figure that out, there's four bytes per line, there's five lines, so four times 5 is 20.

Next, what we see here is some of the other fields. The DSCP field that's right here takes up the most of the next byte. If I drop down, that takes up six of the eight bits of the next byte. And then we see the ECN, which is the last two bits of that byte. Then we see the total length all together. So that's 2960, the total length of the packet there.

Then we see an identification there that lines up as well. We see the different flags. If I click the expand of the flags here, it'll actually show me what each bit is set within here, so we see the bits there. We see the time to live, so that lines up with the time to live field that we saw. We saw the protocol; the protocol in this case is TCP. We see the checksum that's in here. And then we see the source address and destination address. So as you can see, it all lines up with that visual table that we had, or the visual representation of the IP header.

So there you have it. What we did is we generated some traffic and captured that traffic across the network interface. We looked up the DNS to figure out what we were looking at, wikipedia.org, and what IP address it was. Then once we had the IP address, we filtered based off of that IP address to filter it down to the specific packets. We chose one of those packets, and then we looked within the packet to see exactly what fields are within that IP header, to associate it with the visual IP header that we saw on our lesson. So there's the IP version 4 header within our packets and how it's represented in Wireshark.