CloudLabBox
Try the free demo

Packet analysis lab 2 of 12

Wireshark workflow: profiles and statistics

Set Wireshark up the way analysts do. You build a troubleshooting profile with your own columns, colouring rule, filter button and Decode As setting, then use conversations, endpoints, Follow Stream and Export Objects to answer questions about live shop traffic captured on an in-line workstation.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 3,072 MB in total. That fits the free demo too.

In your workspace: Shared, then Packet analysis with Wireshark and tcpdump guided labs, then 02 - Wireshark workflow - profiles and statistics

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Beginner
Time
About 80 minutes
Nodes need
4 vCPU, 3,072 MB
Smallest plan
Lite

The scenario

Fellside Outdoor's web shop runs on SRV: the shop site on port 80, a stock-sync API used by the tills, and the shop's internal DNS. Two PCs use it all day: CL1 browses and syncs stock, CL2 pulls the full price list every ten seconds. The web team wants a Wireshark set-up they can reuse for every shop problem, and some quick answers about this traffic. Your workstation WS is wired in-line between the clients and SRV: its bridge br0 joins eth0 and eth1, so every frame between them passes through it, just as it would through a network tap.

DeviceInterfaceAddressRole
CL1eth010.30.10.21/24till PC: DNS lookups, shop pages, stock sync
CL2eth010.30.10.22/24office PC: downloads the price list
WSbr0 (eth0 + eth1)10.30.10.50/24your analyst workstation, in-line
SRVeth010.30.10.10/24shop server: HTTP 80, stock sync 8085, DNS 53

Your workstation, WS. Open WS's console: a remote desktop, logged in as root (password eve if asked). Start Wireshark from Applications > Internet > Wireshark, or type wireshark & in Applications > System Tools > MATE Terminal. Write answers in /root/answers.txt (pluma /root/answers.txt &) after each Qn:.

What you’ll practise

  • Create a configuration profile and add columns in two ways
  • Write display filters by hand, from the packet details and with membership and logical operators
  • Explain the implicit any and all behaviour of == and != on fields that occur twice
  • Create a colouring rule and a filter button, and use Decode As for a service on a non-standard port
  • Use Capture File Properties, Protocol Hierarchy, Conversations, Endpoints and the I/O Graph
  • Follow a TCP stream, export an HTTP object and export specified packets to a new file

The tasks

  1. Start the clients
  2. Capture and save a working file
  3. Create a profile
  4. Add columns
  5. Display filters
  6. Colouring, marking and the minimap
  7. Decode As
  8. Statistics
  9. Follow a stream and export what you found

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Wireshark workflow - profiles and statistics4 nodes and 1 network, 4 links. Every link is listed as text below the diagram.CL1CL2WSSRVShopeth0eth0eth0eth1eth0
4 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • CL1 eth0 to Shop (network)
  • CL2 eth0 to Shop (network)
  • WS eth0 to Shop (network)
  • WS eth1 to SRV eth0
Nodes in Wireshark workflow: profiles and statistics, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
CL1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
CL2Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
WSEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
SRVEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Packet analysis with Wireshark and tcpdump guided labs.

  3. Open 02 - Wireshark workflow - profiles and statistics and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Packet analysis labs

All Packet analysis labs

Related labs in other courses

CloudLabBox is independent of the Wireshark Foundation, CompTIA and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.