Reference no: EM133085890

Lab Sheet

Objectives
• Investigate Linux file system and basic Linux commands
• Observe IP settings on Windows and Linux
• Use Wireshark to capture and analyse ARP
• Use Wireshark to capture and analyse network layer protocols

Part 1: Investigate Linux File System and Basic Linux Commands
Most students may be familiar with the structure of Windows file system and the way it identifies devices using drive letters. For example
• C: Normally represents the main or part of hard drive that contains the operating system.
• D: It is often used for DVD drive (if one exists)
• E: It is used for removable media like USB sticks or hard drives

However, a totally different file system structure is used in Linux. Devices like external hard drives, USB devices, and network drives, must be mounted into the file system directory somewhere beneath the root of the file system. This is normally done during the installation. When representing parts of Linux file system, we normally represent the entire path starting from /. For example, the Documents directory of user1 is located at /home/user1/Documents/. The directory representing the first USB device on your Linux Lite system is at /mnt/vbox/.

Task 1
Draw a diagram of Linux file system identifying the directories mentioned below.
• /bin/
• /home/
• /home/user2/Downloads/
• /etc/
• /etc/samba/
• /sbin/
• /mnt/
• /mnt/vbox/

Task 2
Determine the primary function of each of the above Linux directories.

Task 3
Draw a hierarchical diagram of above Linux directory structure (not the entire Linux file system).

Task 4
Thunar allows us to navigate through the Linux file system using a GUI, however, experienced Linux users spend most of their time working in Linux terminals with commands and arguments. There are a few commands that allow us to navigate through the Linux file system and determine our current location in the file system.
• cd (change directory command): It allows us to navigate to specific Linux directories. For example cd /home/user1/ takes us to user1's home directory. Another example is cd
/home/user1/Pictures/ which takes us to the Pictures directory of user1. The cd command can navigate to any directory in the Linux file system.
• pwd (print working directory): It shows us our current location in the file Linux system.
• Open a Linux terminal and using the cd and pwd commands navigate to all Linux directories mentioned in Task 1.
• From the Pictures directory enter command cd ..
• Using the pwd command, determine what the cd .. command does in Linux.
Linux file system paths are often quite long and entering an entire path from root of the file system can be tedious. There are many shortcuts that can be used. For example
• . This represents the current directory determined by the pwd command.
• .. This represents the directory one level up in the Linux file system.
• ~ This represents current user's home directory. There are few other examples.
• Linux copy (cp) and move (mv) commands. For example, cp
/home/user1/Pictures/MyPhoto.jpg would copy the file MyPhoto.jpg to current user's home directory. Similarly, cp ../file3 /home/user1/ would copy file "file3" from one directory to the home directory /home/user1/.
• whoami command tells you who you are currently logged in as.
• ls is the Linux list command and is the most frequently used one. It lists contents of current working directory or if a file system path is added, it lists the contents of that path. The ls command has two main command line arguments that tell us more about the contained file system.
o ls -l is a long listing (it displays extra information about each file/directory).
o ls -a is a listing that includes hidden files (files that start with a period).
o ls -la does both.
• From command line, navigate to directory /etc/gufw/.
• Use command ls -la to get a long listing of files within /etc/gufw/.
• Use the Internet and determine what each column of an ls -la listing tells you about the associated files. Note: we are not concerned with what the files of /etc/gufw/ do. We just want some idea of what the ls -la listing tells us about the associated files.

Part 1 Task (to earn marks)
To gain one mark, demonstrate and that you can navigate Linux file system from command line and that you have some understanding of the fields displayed in an ls -la listing of a Linux file system directory. Include evidence in the Lab Report 2.

Part 2: Observing IP Settings on Windows and Linux
Windows ipconfig Command
Windows ipconfig command allows you to determine current IP configuration of a Windows machine. The basic form of the command shows the following information.
• IPv4 address
• Subnet mask
• Default gateway
• IPv6 address
By using the ipconfig /all option, you can obtain other related information, including
• Physical address (MAC address)
• DHCP status (enabled or disabled)
• DHCP lease information (how long the DHCP has allocated the IP setting to you)
• DHCP server's IP address
• DNS server's IP address

Linux ifconfig Command
Like the ipconfig command in Windows, the ifconfig command in Linux displays basic IP settings including
• IPv4 address
• Subnet mask
• HWaddr (MAC address)
• IPv6 address
To see the gateway address, we use route command.

Gateway Address
Route command displays a Linux machine's routing table. The entry labelled default is the gateway address. You may have to determine the default entry first by running the route command and then enter command route -n to fist the actual IP address of the gateway.

Part 3: Examining Protocols with Wireshark
Wireshark is a standard protocol analyser that allows us to capture and analyse network traffic. It is also used as a software diagnostic tool. It allows us to determine the interactions that occur between client and server applications. It is also used in forensic analysis in the cyber security circle. Traffic generated by viruses and bots on client computers can be examined to determine the sources and lead to the mitigation of security threats.

Task 1
Prior to examining an IP header, we must first capture one.
• From Linux Lite Menu, select -> Internet -> Wireshark (this should run Wireshark).
• If you double click on the name of an interface, you will start capturing background network traffic.
• After capturing for 10-20 seconds, you should have captured significant traffic.
• Click on a packet in the Packet list pane (the one at the top). Look into the Packet decode pane. You will find all headers associated with the packet selected in the packet list pane.
• Find a packet that has an IP header and click the expand/contract triangle in the Packet decode pane. This will allow you to see the details of this IP header. You will investigate various fields of this header by answering the following questions.
o What is the IP version?
o What is the length of the IP header in this case?
o What does the first flag tell about the packet?
o What is the value of Time to Live field? What does this mean?
o What is the value of header checksum?
o What is the function of header checksum field?
o What is the IP address of host that sent this packet?
o Where can you find the hexadecimal value of the IP address in Wireshark?
o What is the IP address of destination host?

Task 2: Examining an ARP Request and Response
ARP is a data link layer protocol and you will not see an IP header in ARP Wireshark captures. The role of ARP is to determine the MAC address of a machine with a specific IP address. The ARP does this by sending a broadcast to the network asking which machine has the IP address. It then waits for a response from the machine with the IP address in question.
To capture an ARP packet, you need to find a machine to contact. In the Federation University's labs, you need to determine the IP address of another machine (one that does not have an entry in your machine's ARP cache). To look at your ARP cache,
• Run Wireshark -> Capture -> options.
• Select the correct interface.
• Enter the word arp in the capture filter box.
• Click the Start button.
To generate an ARP request and reply,
• Open a terminal.
• ping the ip address of the machine identified above. You should see an ARP request and an early reply captured in Wireshark.
• Click the red stop button to stop Wireshark capture.

As ARP is a data link layer protocol, therefore, it will only work on your local network. If you ping a remote IP address (e.g., www.google.com), you will not get ARP packets because the communication will go through the gateway, for which there is already an entry in the ARP cache. If you need to remove an entry from ARP cache, you can use command (sudo arp -d <ip_address>). If you face any problem generating the ARP traffic, there is an ARP capture on Moodle. Once you have ARP request and reply, closely examine them in Wireshark. You should be able to see the request that is missing the MAC address of the target machine as shown below.

Task 3: Examining DNS Traffic
DNS is a service on IP networks that translates names like www.google.com to its associated IP address. When you enter a url into a browser, that url needs to be converted to its associated IP address. If you try to ping a remote website, the DNS will perform a lookup and return the IP address in question. In this task, you will ping a remote website to generate the DNS traffic and capture it with Wireshark.
• Run Wireshark -> Capture -> options.
• Select the correct interface.
• Enter the word port 53 in the capture filter box.
• Click the Start button.
To generate the DNS request and reply
• Open a terminal.
• ping website www.apple.com.
• Click stop button to stop the capture.

In the captured traffic, examine the following.
• Sequence of headers in each packet. From this, you should be able to identify the layer at which the DNS works.
• What does the query ask for?
• What is the response?
• Associated fields in the DNS header.

Part 3 Task
Demonstrate that you have captured DNS traffic and explain what has happened in the interactions. Note - You can find DNS Wireshark captures in your Moodle shell. These captures are for students who are facing difficulties in capturing the required traffic. These captures will allow you to analyse the contents on each packet type.

Attachment:- Analyse network layer protocols.rar