DEMO: Wireshark, Ports

Capturing the Data

First of all, we need to capture this data. So what I'm going to do is, with Wireshark, monitor the Ethernet connection. Then I'm going to go to the Pi address in my browser to bring up our web page. And then the last thing that I'm going to do is close out of the browser, because there's some TCP connections that get broken back down with this, so I want to make sure I capture that. And then I will stop my capture.

What's in the Capture

So now let's go back and look at some of the traffic that's gone across this Ethernet interface. One of the things that I see right off the bat is that there's this Cisco information that's coming across that Ethernet interface. Once again, that's just the switch that this is plugged into. It's trying to discover other switches, and it's trying to use Spanning Tree Protocol and some other protocols to make connections. So we can ignore all this stuff that's coming from the Cisco.

I scrolled to the top, and one of the first things as far as communication between my demo laptop — which is this Dell MAC address right here — and the Pi, which is this Raspberry MAC address right here. So one of the first things I see are these ARP requests, which makes sense, because I went out to this IP address, but it needs to know the MAC address to communicate on that layer 2, to know where the frame goes, what to put in the frame as a layer 2 destination. So it goes and does this ARP request and it says, who is 10.1.0.3, and the demo Pi replies back with the MAC address that's on that demo Pi.

The next thing it does is these three packets right here establish a TCP connection. But this establishes the TCP connection. Once that connection is established, then the demo laptop requests a web page, and then this is the reply back — the web page actually gets transferred back. So we see that that gets transferred back. So there's this TCP communication that happens back and forth. Once that is established, then there is some other chatter in here. We get down to here and we see the TCP connection ending, and then some more finish of the TCP connection, so it closes up that.

So we're going to be talking about all those components, but for now we're just going to take a look at the ports and what ports are being used for this transfer back and forth.

The Ports in Use

So I've scrolled up to the top here, and right after my ARP requests I can see that we have the communication that starts establishing that TCP connection. Right here in the info it shows us that we're using port 60425 to port 80. So we're reaching out on port 80. We know that that's HTTP now, and that it's requesting that web page — or it's going to request a web page — but it's reaching out to that port, and that demo Pi is listening on port 80 for requests for that web traffic. And then the response comes back from the demo Pi, from port 80 to 60425. And then there is another connection that happens from the demo laptop to the Pi: the demo laptop has a source port of 60425 and it's going to the destination port of port 80.

So we're seeing how these are communicating back and forth, and it's keeping track of this thread of communication via these ports right here — both the source port, where it's keeping track of the conversation, and the destination port, where it's keeping track of what service it's actually referencing.

This section right here just shows us a brief synopsis of that TCP connection that's establishing. But down here, if we go down to where our packet information is, we can see the Transmission Control Protocol right here, and it gives us a brief summary once again. The source port is 60425, destination port is port 80. We can open this up and then it breaks it down even further, and we can see the section down there of where the header looks like when it comes to the actual hexadecimal — or if I wanted to switch to binary, I can show it as bits.