IT443 – Network Security Administration Week 2 – Wireshark Instructor: Alfred J Bird, Ph.D., NBCT Door Key: * Office – McCormick 3rd floor 607 ( ) Office Hours – Tuesday and Thursday, 4:00 pm to 5:15pm 1

Some Postulates about Network Security You can never prove something perfect, all you can do is fail to prove that it has some faults! Keep looking! If a lot of smart people have failed to solve the problem, then it probably won’t be solved (soon!) (p41 in the text) Security people need to remember that most people regard security as a nuisance rather than as needed protection and left to their own devices they often carelessly give up the security that someone worked so hard to provide. (p245 in the text) 2

Today’s Objectives Install and set up wireshark in a Ubuntu VM environment Play with wireshark looking at different protocols 3

Installing Wireshark If it does not exist, create a directory c:/ubuntu and give it read/write privileges. Copy the iso for Ubuntu workstation into the directory from my jumpdrive (or download it) Open VMWare and create a new VM with Ubuntu desktop Use sysadmin/sysadmin for username/password. Install wireshark and do updatesmto the system. Open a terminal window and execute the command sudo su so you function as root. Run wireshark in the terminal window. 4

Playing with Wireshark. Choose the eth0 interface and start collecting packets Look at some random packets and see if they make any sense to you. Open Network Tools and ping and look at the packets that go across the wirewww.google.com Look at an ARP protocol and try to understand it 5