CloudLabBox
Try the free demo

Packet analysis lab 1 of 12

Capture where it matters: port mirroring and ring buffers

Before you can analyse a problem you need the right packets. You capture on a server with tcpdump, find out why a capture PC on a switch port sees almost nothing, mirror the server's port to it with SPAN, and set up capture filters, stop conditions and ring buffers in Wireshark and dumpcap.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 2,816 MB in total. That fits the free demo too.

In your workspace: Shared, then Packet analysis with Wireshark and tcpdump guided labs, then 01 - Capture where it matters - port mirroring and ring buffers

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Beginner
Time
About 60 minutes
Nodes need
4 vCPU, 2,816 MB
Smallest plan
Lite

The scenario

Fellside Outdoor sells walking and climbing gear from a shop in Kendal. The till PC CL1 pulls the stock list from the stock server SRV every few seconds, and the shop manager says it "sometimes hangs". Before anyone can say why, you need the right packets, captured in the right place. In this lab you try the three places an analyst can capture from here: the server itself, an ordinary switch port, and a mirrored switch port. Then you set captures up to run safely for hours.

DeviceInterfaceAddressConnects to
SRVeth010.20.10.10/24SW1 Gi0/1 (stock web server)
CL1eth010.20.10.21/24SW1 Gi0/2 (till PC, fetches the stock list)
WSeth010.20.10.50/24SW1 Gi0/3 (your analyst workstation)
SW1Gi0/1 to Gi0/3noneaccess switch, VLAN 1

Your workstation, WS. Open WS's console: it's a remote desktop, and you're logged in as root (password eve if asked). Start Wireshark from the Applications menu (Internet > Wireshark), or open Applications > System Tools > MATE Terminal and type wireshark &. You'll also use the terminal for dumpcap, capinfos and your answers file. Wireshark warns that it's running as root: that's expected in this lab.

Answers. Some tasks ask a question. Write the answers in /root/answers.txt on WS, after each Qn:, for example Q1: ARP. Open it with pluma /root/answers.txt & (a text editor) or vim. Exact formats are given in the file.

What you’ll practise

  • Capture on an endpoint with tcpdump, live and to a file, with a packet limit
  • Choose the right capture interface and explain what a switch port can and can't see
  • Configure a SPAN session on a switch and capture the mirrored traffic
  • Write capture filters in BPF syntax and tell them apart from display filters
  • Stop captures automatically and keep long captures in a ring buffer with tcpdump and dumpcap

The tasks

  1. Start the server and the till
  2. Capture on the server itself with tcpdump
  3. Keep a long capture in a ring buffer with tcpdump
  4. Capture from an ordinary switch port
  5. Mirror the server's port with SPAN
  6. Capture only what you need, and stop automatically
  7. A ring buffer on the analyst workstation

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Capture where it matters - port mirroring and ring buffers4 nodes, 3 links. Every link is listed as text below the diagram.SW1SRVCL1WSGi0/3eth0Gi0/1eth0Gi0/2eth0
4 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SW1 Gi0/1 to SRV eth0
  • SW1 Gi0/2 to CL1 eth0
  • SW1 Gi0/3 to WS eth0
Nodes in Capture where it matters: port mirroring and ring buffers, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
SRVAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
CL1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
WSEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Packet analysis with Wireshark and tcpdump guided labs.

  3. Open 01 - Capture where it matters - port mirroring and ring buffers and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Packet analysis labs

All Packet analysis labs

Related labs in other courses

CloudLabBox is independent of the Wireshark Foundation, CompTIA and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.