Lab 4 – Using WireShark (formerly Ethereal)

Part 1: Check computer addresses and start up Wireshark Capture

Determine the Physical MAC address and the IP address for the Ethernet interface of the computer you are using.
Start up Wireshark, click CaptureàInterfaces and click the Capture button corresponding to your active Ethernet interface. Wireshark will begin running in Capture Mode and will open up a Wireshark Capture window showing you how many packets have been captured in real time.

Part 2: Download Web Page

With Wireshark still running in Capture Mode, start up your favorite browser (Internet Explorer, Mozilla, Firefox or whatever).
Enter an URL for any website (E.g.: use following address)

http://facweb.cs.depaul.edu/cwhite

A web page should appear in your browser.
Close your browser window.
Go back to the Wireshark Capture window and click the Stop button to stop the packet capture.

Part 3: Verify that the Web Page Download has Been Captured

Back in the Wireshark window, you should now see lots of packets in the top summary pane. You can filter out all packets except HTTP packets by typing the word “http” into the Filter box (click ViewàFilter Toolbar if you don’t see a Filter box at the top). This will make things much easier to read.
You should see a packet containing something like “GET /facweb.cs.depaul.edu/cwhite” sent by your PC to request the web page download.
If the next packet listed (containing the reply from the web server to your PC) contains “HTTP/1.1 200 OK” and the next 3 are “Continuation” packets, then you have successfully captured the packets containing the lab html web page. Skip the following step.
On the other hand, if the reply from the web server contains “HTTP/1.1 304 Not Modified”, then this means Wireshark did not capture the packets from the web site because the web page was already stored (cached) in your browser. In this case you must clear your browser cache and then go back and re-do the capture as follows:
First, you must clear the web cache in your browser.
For Internet Explorer, click Tools à Internet Options, then, under the General tab, click the Delete Files button within the Temporary Internet Files box area.
For Firefox, click Tools à Options, then Privacy, Cache and click Clear.
For other browsers, you’re on your own.
Now in your Wireshark window, again select CaptureàInterfaces and click the Capture button corresponding to the Ethernet interface. When prompted whether to save the previous capture, click Continue without saving.

Go back to Part 2, step 1 above to download the web page again while Wireshark is capturing packets.