Wireshark Analysis Teaching
This Wireshark Network Analysis project focuses on capturing and examining real network traffic to better understand how data moves across a network.
Using Wireshark, packet captures were analyzed to identify common protocols such as DNS, HTTP, and TCP, and to study how devices communicate at different layers of the network.
We are going to be dissecting the DNS packet highlighted in grayish blue and see their ethernet frame, UDP/TCP frame the source and destination.
Starting With Destination: The destination is provided with a MAC Address (A hardware Identifier) of (3c:78:95:3d:bf:8c).
MAC Addresses are split up with a OUI and Personal Identifier
The first 18 bits (eg. 3c:78:95) is the Organization Unique Identifier this shows what Organizations use to identify their equipment
The last 18 bits are your personal identifier for that specific Hardware.
This can also be Used for Source.
There’s many different “types” of Ethernet frames. ill be using the big 4 as an example. For this Packet we have 0x0800, so IPv4.
I recommend to put this picture on another screen to compare what is being said below.
This is our IPv4 Header frame. I’m going to go through every header and explain what they mean so even someone with little to no experience can easily read this without any jargon.
Version: 0100 (Binary) This is the version of the IP header 0100 = 4 In binary, so its an IPv4 Frame 🙂 0110 = 6 In binary because 2+4 = 6 In binary.
**How? well it’s easy once u see it.
Starting from right to left you keep doubling.**
0000 = 0
0001 = 1
0010 = 2
0100 = 4
1000 = 8