1. Network Analyzer :- Introduction to Ethereal Computer Networking (Graduate Class)

2. What is Ethereal ? Ethereal is a GUI network protocol analyzer Display filters in Ethereal are very powerful Follows the rules of the pcap library

3. Functions capturing network traffic Decodes packets of common protocols Displays the network traffic in human- readable format

4. Screen Layout of Ethereal A protocol tree is shown, allowing you to drill down to exact protocol or field that you interested in. a hex dump shows you exactly what the packet looks like when it goes over the wire. The summary line, briefly describing what the packet is. Filename Of Current File

5. Edit -> Preferences ->Columns

6. Enable Protocols

8. Start Capturing

9. Select Capture Options

10. Capture Filters The capture filter syntax follows the rules of the pcap library This syntax is different from the display filter syntax. Refering manual page of tcpdump Sample filters ◦ src ip 192.168.1.1 ◦ ether src 00:50:BA:48:B5:EF

11. Capture Filters A capture filter for HTTP than captures traffic to and from a particular host -tcp port 80 and host 10.10.10.5 A capture filter for HTTP than captures traffic not from a particular host -tcp port 80 and not host 10.10.10.5 A capture filter to and from an ethernet address -ether 00:00:01:01:02:22

12. Capturing Packets Start Monitoring Manual Stop

13. Display Packets Captured

18. Column Sorting Output is Sorted By Frame No By Default After Sorting By Info

19. Conversation List

20. Saving Packets Captured

21. Display Filters C-like symbols, or through English-like abbreviations: eq, == Equal ne, != Not equal gt, > Greater than lt, < Less Than ge, >= Greater than or Equal to le, <= Less than or Equal to

22. Display Filters GUI Quick Way to Learn Display Filter Commands 1. 2. 3.

23. Why Packet Analyzing in this class ? Useful in Developing Network Application As a guideline when error encountered

24. Some Useful Information TCPDUMP MAN Page - http://www.tcpdump.org/tcpdump_man.html IP Protocol -http://www.networksorcery.com/enp/protocol/ip.htm

25. Demonstration