Reference no: EM132626472

Lab Sheet 1

Objectives
• Investigate Linux file system and basic Linux commands
• Observe IP settings on Windows and Linux
• Use Wireshark to capture and analyse ARP
• Use Wireshark to capture and analyse network layer protocols

Part 1: Investigate Linux File System and Basic Linux Commands
Most students may be familiar with the structure of Windows file system and the way it identifies devices using drive letters.For example
• C: Normally represents the main or part of hard drive that contains the operating system.
• D: It is often used for DVD drive (if one exists)
• E: It is used for removable media like USB sticks or hard drives

However, a totally different file system structure is used in Linux. Devices like external hard drives, USB devices, and network drives, must be mounted into the file system directory somewhere beneath the root of the file system. This is normally done during the installation. When representing parts of Linux file system, we normally represent the entire path starting from /. For example, the Documents directory of user1 is located at /home/user1/Documents/. The directory representing the first USB device on your Linux Lite system is at /mnt/vbox/.

Task 1
Draw a diagram of Linux file system identifying the directories mentioned below.
• /bin/
• /home/
• /home/user2/Downloads/
• /etc/
• /etc/samba/
• /sbin/
• /mnt/
• /mnt/vbox/

Task 2
Determine the primary function of each of the above Linux directories.

Task 3
Draw a hierarchical diagram of above Linux directory structure (not the entire Linux file system).

Task 4
Thunar allows us to navigate through the Linux file system using a GUI, however,experienced Linux users spend most of their time working in Linux terminals with commands and arguments.There are a few commands that allow us to navigate through the Linux file system and determine our current location in the file system.
• cd (change directory command): It allows us to navigate to specific Linux directories. For example cd /home/user1/ takes us to user1's home directory. Another example is cd /home/user1/Pictures/ which takes us to the Pictures directory of user1.The cd command can navigate to any directory in the Linux file system.
• pwd (print working directory): It shows us our current location in the file Linux system.
• Open a Linux terminal and using the cd and pwd commands navigate to all Linux directories mentioned in Task 1.
• From the Pictures directory enter commandcd ..
• Using the pwd command, determine what the cd.. command does in Linux.
Linux file system paths are often quite long and entering an entire path from root of the file system can be tedious. There are many shortcuts that can be used. For example
• .This represents the current directory determined by the pwd command.
• ..This represents the directory one level up in the Linux file system.
• ~This represents current user's home directory.
There are few other examples.
• Linux copy (cp) and move (mv) commands. For example, cp /home/user1/Pictures/MyPhoto.jpgwould copy the file MyPhoto.jpg to current user's home directory. Similarly, cp ../file3 /home/user1/ would copy file "file3" from one directory to the home directory /home/user1/.
• whoamicommand tells you who you are currently logged in as.
• lsis the Linux list command and is the most frequently used one. It lists contents of current working directory or if a file system path is added, it lists the contents of that path.The ls command has two main command line arguments that tell us more about the contained file system.
o ls -l is a long listing (it displays extra information about each file/directory).
o ls -a is a listing that includes hidden files (files that start with a period).
o ls -la does both.
• From command line,navigate to directory /etc/gufw/.
• Use command ls -la to get a long listing of files within /etc/gufw/.
• Use the Internet and determine what each column of an ls -la listing tells you about the associated files. Note: we are not concerned with what the files of /etc/gufw/ do.We just want some idea of what the ls -la listing tells us about the associated files.

Part 1 Task
To gain one mark, demonstrate to your tutor that you can navigate Linux file system from command line and that you have some understanding of the fields displayed in an ls -la listing of a Linux file system directory.

Part 2: Observing IP Settings on Windows and Linux
Windows ipconfig Command
Windows ipconfig command allows you to determine current IP configuration of a Windows machine.The basic form of the command shows the following information.
• IPv4 address
• Subnet mask
• Default gateway
• IPv6 address
By using the ipconfig /all option,you can obtain other related information, including
• Physical address (MAC address)
• DHCP status (enabled or disabled)
• DHCP lease information (how long the DHCP has allocated the IP setting to you)
• DHCP server's IP address
• DNS server's IP address

Linux ifconfig Command
Like the ipconfig command in Windows, the ifconfig command in Linux displays basic IP settings including
• IPv4 address
• Subnet mask
• HWaddr (MAC address)
• IPv6 address
To see the gateway address, we use route command.

Gateway Address
Route command displays a Linux machine's routing table. The entry labelled default is the gateway address.You may have to determine the default entry first by running the route command and then enter command route -n to fist the actual IP address of the gateway.

Part 3: Examining Protocols with Wireshark
Wireshark is a standard protocol analyser that allows us to capture and analyse network traffic. It is also used as a software diagnostic tool. It allows us to determine the interactions that occur between client and server applications. It is also used in forensic analysis in the cyber security circle. Traffic generated by viruses and bots on client computers can be examined to determine the sources and lead to the mitigation of security threats.

Task 1
Prior to examining an IP header, we must first capture one.
• From Linux Lite Menu, select -> Internet -> Wireshark (this should run Wireshark).
• If you double click on the name of an interface, you will start capturing background network traffic.
• After capturing for 10-20seconds, you should have captured significant traffic.
• Click on a packet in the Packet list pane (the one at the top). Look into the Packet decode pane.You will find all headers associated with the packet selected in the packet list pane.
• Find a packet that has an IP header and click the expand/contract triangle in the Packet decode pane. This will allow you to see the details of this IP header. You will investigate various fields of this header by answering the following questions.
o What is the IP version?
o What is the length of the IP header in this case?
o What does the first flag tell about the packet?
o What is the value of Time to Live field?What does this mean?
o What is the value of header checksum?
o What is the function of header checksum field?
o What is the IP address of host that sent this packet?
o Where can you find the hexadecimal value of the IP address in Wireshark?
o What is the IP address of destination host?

Task 2: Examining an ARP Request and Response
ARP is a data link layer protocol and you will not see an IP header in ARP Wireshark captures.The role of ARP is to determine the MAC address of a machine with a specific IP address. The ARP does this by sending a broadcast to the network asking which machine has the IP address. It then waits for a response from the machine with the IP address in question.
To capture an ARP packet, youneedto find a machine to contact. In the Federation University's labs, youneed to determine the IP address of another machine (one that does not have an entry in your machine's ARP cache). To look at your ARP cache,
• Run Wireshark -> Capture -> options.
• Select the correct interface.
• Enter the word arp in the capture filter box.
• Click the Start button.
To generate an ARP request and reply,
• Open a terminal.
• ping the ip address of the machine identified above. You should see an ARP request and an early reply captured in Wireshark.
• Click the red stop button to stop Wireshark capture.
As ARP is a data link layer protocol, therefore, it will only work on your local network.If you ping a remote IP address (e.g.,www.google.com), you will not get ARP packets because the communication will go through the gateway, for which there is already an entry in the ARP cache.If you need to remove an entry from ARP cache, you can use command (sudoarp -d <ip_address>). If you face any problem generating the ARP traffic, there is an ARP capture on Moodle.Once you have ARP request and reply, closely examine them in Wireshark.You should be able to see the request that is missing the MAC address of the target machine as shown below.

Task 3: Examining DNS Traffic
DNS is a service on IP networks that translates names like www.google.com to its associated IP address.When you enter a url into a browser, that urlneeds to be converted to its associated IP address.If you try to ping a remote website, the DNS will perform a lookup and return the IP address in question.In this task,you will ping a remote website to generatethe DNS traffic and capture it with Wireshark.
• Run Wireshark -> Capture -> options.
• Select the correct interface.
• Enter the word port 53 in the capture filter box.
• Click the Start button.
To generate theDNS request and reply
• Open a terminal.
• ping website www.apple.com.
• Clickstop button to stop the capture.
In the captured traffic, examine the following.
• Sequence of headers in each packet.From this, you should be able to identify the layer at which the DNS works.
• What does the query ask for?
• What is the response?
• Associated fields in the DNS header.

Part 3 Task
To gain one mark, demonstrate to your tutor that you have captured DNS traffic and explain what has happened in the interactions.Note- You can findDNS Wireshark captures in your Moodle shell. These captures are for students who are facing difficulties in capturing the required traffic.These captures will allow you to analyse the contents on each packet type.

Lab Sheet 2

Objectives
• Capture and investigate transport layer protocols
• Investigate Linux file system and basic Linux commands

Part 1: Investigate HTTP
Simple network interactions can be analysed using Wireshark.Two Wireshark HTTP interactions are available on Moodle.
• Capture 1: browser request for a HTML page
• Capture 2:a request including two images in the html page
Upon completion ofpart 1, you may like to capture each HTTP interaction live.

Task 1
Download captured file from Moodle and open it in Wireshark. Observe Wireshark display. Filename is Phoebe-HelloITECH1102.pcapng. This capture contains 10 packets of a simple HTTP GET from a server named phoebe.
• The first 3 packets are from 3-way handshaking mechanism setting up the connection between client web browser (Firefox) and web server(phoebe).Note the SYN, SYN/ACK, and ACK flags.
• Packet 4 is a HTTP request from web browser asking for a specific html page.
• Packet 5 is an acknowledgement from server to the requesting client. This packet acknowledges that the server successfully received 389 bytes from web client.
• Packet 6 is the requested html page sent by the server to the client.
• Packets 7 & 8 are forserver closing the connection with client.
• Packets 9 & 10 are for client closing its connection with server.

Task 2
If you look at the first packet, you will see in the packet list pane that the sequence number is zero (seq=0).Further down in the Wireshark display, you will see larger sequence and acknowledgement numbers, e.g., 390, 374, etc. These are relative sequence and acknowledgement numbers. They are relative to the initial sequence numbers setup during the TCP connection (3-way handshake).To view the actual values, we are going to change the preferences in Wireshark.
• From the Edit Menu, Preferences -> Protocols -> TCP ->Uncheck Relative Sequence Numbers.
You are now seeing actual sequence and acknowledgement numbers as opposed to the relative ones.You should now be able to see that the Initial Sequence Number (ISN) from client to the server is 1043872907 andthe ISN from server to the client is 3447850100. Here, you have noticed that the ISNs for a connection between client and server are totally different from the opposite connection (server to client). This is less obvious when using the relative sequence numbers.
Port numbers used by clients and servers can be seen in the packet list pane or the packet decode pane of Wireshark.
• What port number is used by client?
• What port number is used by server?
• Are these port numbers consistent?
• What are the associated sockets of client and server?

Task 4
Packet decode pane shows all aspects of the TCP header. Flags indicate main functions of each TCP segmentas shown below.

You may have noticed that the flags are either On (1) or Off (0) and only take one bit.Choose a few packets from capture. Note the statuses of flags and how they relate to the display in the packet list pane.

Task 5
Following screenshot shows 5 client and server packets, respectively.

In this screenshot, we can see the following.
• Initial relative sequence number is zero.
• After it is acknowledged, it became 1.
• After sending 389 bytes, it increased to 390.
Try doing a similar analysis of the traffic coming from last 5 packets, i.e., traffic from server to client.

Task 6
Download the second capture from Moodleand analyse it. Try to discover what is happening in this Wireshark capture. You may need to refer to the Internet if you are unsure about traffic. This capture is like the previous one, however, two images are downloaded as a part of the web page.

Part 1 Task
To gain one mark in this lab, demonstrate to your tutor that you have understood various aspects of the two Wireshark captures.

Part 2:Commands in Linux, i.e.,Copy (cp),Move (mv),and Remove (rm)
When we run a terminal from taskbar, a program called Linux shell (equivalent to command line in Windows) executes.

Default shell in Linux Lite is bash shell. This shell allows Linux users to administer a Linux system by entering Linux commands and creating and running scripts.The bash shell interprets the commands entered by us and displays results on screen.Most commands require arguments that often include paths to files or directories.To specify a directory, it is a good practice to use a forward slash in the end of the directory reference to indicate it is a directory, e.g., /home/user2/MyGames/. To specify a file, you use a directory reference followed by the filename, e.g., /home/user2/MyGames/game1.exe.

In last week's lab, we used dot (.) and double dots (..) to represent the current and level-up directories, respectively. We also saw how tilde character (~)can be used to represent current user's home directory. In this week's lab, we will practice othercommands, e.g., shell commands, and include wildcards, i.e.,"?"and "*".Wildcards are used in a file reference to specify multiple files. A question mark in a file reference indicates any single character in place of the question mark, e.g., file? would specify any of the following filenames, e.g.., file1, file2, file4, fileC, etc.An asterisk in a file reference can represent any number of characters (zero or more), e.g., file* would specify any of the following filenames, e.g., file, file123, fileAbc, etc.Wildcards are particularly useful when looking for multiple files in the ls (list) command or copying multiple files from one place in the Linux file system to another.
There are two categories of file system references in Linux, i.e., absolute and relative. The absolute file references specify every directory from root of the file system to the file (or files) in question. Theabsolute file references always start with a forward slash (/). Few examples are
• /home/user1/file1
• /home/user1/
• /home/user1/*
• /home/user1/file2??.conf
Relative file references are file references that are relative to the current working directory as displayed in the pwd command.Relative file references never start with a forward slash. Few examples are
• file1
• ../dir2/file
• .
• ..
• ~/vault/
For practice, we need to create a directory containingmultiple files. To do this, complete the following set of commands.
• cd/
• sudomkdirfileStore
• cd fileStore
• sudomkdiroldSongs
• cd oldSongs
• sudo touch song11
• sudo touch song12
• sudo touch song13
• sudo touch song45
• sudo touch song55
• sudo touch song65
You should have a directory /fileStore/oldSongs/ that contains six files.Now create a directory under/home/user1 named songBackup using the mkdir command.
The format of copy command iscp source destination, where source and destination are file references.Use bash shell commands to complete the following tasks.
• Use absolute addresses for both source and destination and copy song11 to songBackup/.
• Use absolute addresses for both source and destination and copy song11, song12, and song13 to songBackup.
• Use absolute addresses for both source and destination and copy any song that ends in 5 to songBackup.
• Delete all files fromsongBackup directory with the rm commands and the wildcard *.
• Repeat first threetasks using relative addresses for both the source and destination.
To test your skills, try the following tasks.
• Use the ls command to list multiple files within Linux directories.
• Change directory to /bin.
• List all files that start with letter c.
• Determine how many files start with ch.
You can furthertest yourskills by copying single file or multiple files from any location in the Linux file system to your home directory.

Part 2 Task
To gain one mark, demonstrate to your tutor that you can successfully use Linux cp and mv commands andyou understand how to use wildcards (? an *) and relative file references (. and ..) in Linux commands.

Attachment:- Lab Sheet.rar