lab completed in dorm room 9/13

Analyze Traffic to a Remote Network (different LAN)

• Opened Terminal (Linux)
• Opened Wireshark and started a capture
• Pinged Google Public DNS server (8.8.8.8) from terminal
• Stopped capture
• Analyzed ICMP response from Google
  • Source MAC: BC:24:11:58:7D:22
  • Destination MAC: BC:24:11:11:E7:58

Examine both sides of a ping

• Found a partner in class and got their IP address
• Pinged partner's IP from workstation and confirmed a response
• Started a Wireshark capture, pinged partner's IP, stopped capture
• Analyzed capture
  • Source MAC: BC:24:11:8E:5D:CB
  • Destination MAC: BC:24:11:11:E7:58

Capture both sides of the ping request

• Started Wireshark captures on both PCs
• Pinged partner's IP from workstation
• Stopped captures on both workstations
• Compared ICMP traffic on both devices
  • Workstation: Source BC:24:11:8E:5D:CB, Destination BC:24:11:11:E7:58
  • Partner's workstation: Source BC:24:11:11:E7:58, Destination BC:24:11:8E:5D:CB

Q: Does the source MAC address from the Google ping look familiar from prior labs? Is it Google's server's MAC address?
A: It's the default gateway's MAC address, not Google's.

Q: Does your partner's MAC address match the address from your traffic capture? If not, what do you think happened?
A: Yes, matched — same as seen in class.

Q: Why do you think the source/destination MACs on both workstations are different or the same?
A: Same, just reversed — hardware wouldn't have changed in the span of 5 minutes.