# Communication Networks/Ethereal
## Ethereal

Ethereal is a network packet analyzer or a “packet sniffer” as it is called. It was started by Gerald combs in 1997 to track down network problems. Since then Ethereal has been used as the main tool to track and manage network problems and also for R & D purposes.. Ethereal captures network packets from the network during a live network data transmission and gives a detailed summary or description about the packets such as its source and destination, protocols used, packet parameters, network standard, checksum, ports information and much more.
Ethereal is widely used in the networking field as it has many features. some of them are as follows.
* Runs on many platforms such as Windows and Unix.
* Captures live data packets and gives detailed information.
* Saves all the information to be reviewed later.
* Filters packet search on many criteria.
* Supports around 780 protocols.
* Gives detailed summary and statistics after capturing.
* Moreover it is an open software.
And many more.
Ethereal does not detect or troubleshoot the network problems, but it is very important for network management and security as it keeps track of all the packets sent to and fro from your network interface.

### Getting started
#### Getting ethereal

Ethereal is a freeware. Simply download the Ethereal installer from: http://www.ethereal.com/download.html#releases and execute it.
After installing the ethereal package we start it to capture packets. The Ethereal’s Menu options are vast and covers almost all the aspects or options of packet capturing. The basic options of File, Edit, View, etc. have their usual functions. We will go in to the details of the menu afterwards. Let's start capturing packets, because then only you will grasp the real sense of using it. In the menu there is a Capture option. If we click on that button it asks for other options which are essential to both start and customize data capture.
Some of the options under capture tab are:
* Interface: This menu item brings up a dialog box that shows what's going on at the network interfaces Ethereal knows of and we can select our desired interface and capture data on that particular interface.
* Options: This the most important of all the dialog boxes. This menu item brings up the Capture Options dialog box and allows you to start capturing packets. It has all the main options that are required for any packet capturing. It allows you to capture data in promiscuous mode, assign some capture filter, specify capture file where captured packets are to be stored, specify name resolutions and lot lot more. The capture options window is self explanatory and guides you through the various options and gives information about them. The options window is shown below.
Start: It helps to start capturing data immediately with previous settings.
Capture Filters: This menu item brings up a dialog box that allows you to create and edit capture filters which helps you to be more specific with your data capturing.. You can name filters, and you can save them for future use.
After specifying all the options we can start capturing data. when the capturing is stopped then the detailed information is displayed in form of three panes. Which are as follows:
* The Packet List pane: The packet list pane displays all the packets in the current capture file. Each line in the packet list corresponds to one packet in the capture file. If you select a line in this pane, more details will be displayed in the "Packet Details" and "Packet Bytes" panes. This pane gives information regarding the time, destination and source address, protocol used and any other additional information.
* The packet details pane: The packet details pane shows the current packet (selected in the "Packet List" pane) in a more detailed form. This pane shows the protocols and protocol fields of the packet selected in the "Packet List" pane. The protocols and fields of the packet are displayed using a tree, which can be expanded and collapsed
* The packets bytes pane: The packet bytes pane shows the data of the current packet in the hexdump form. When we select some message in the packet list pane, corresponding information is displayed in the other two panes. All types of descriptions on the various topics related to any data capture are provided in these three panes. Let’s explain this by taking an example.
References: http://www.ethereal.com/docs/

### Example 1 - Capture of yahoo messenger

Below is just an explanation of the ethereal capture of the Yahoo messenger. It takes you through all the basic steps and explains each and every step as detailed as possible.Yahoo messenger use client/server technology for communication. The protocol it uses is yahoo messenger protocol. The yahoo protocol is a application layer protocol, which run over the HTTP and TCP.

#### Yahoo messenger protocol header

The yahoo messenger protocol header is shown below. Each yahoo messenger messages start with the following data format.
| 4 bytes | 4 bytes | 4 bytes | 4 bytes | 2 bytes |
| YMSG | YMSG | Version | Version | Packet Length |
| service | status | status | session | session |
| Data 0 to 65535 bytes |||||
HTTP and yahoo messenger protocol header sample
The server acts as a proxy between two clients. All communications between clients go through the server.
The client and the server both use connection oriented method to establish connection between each other. They use TCP for the same. When the connection is established, they use HTTP protocol to send and receive data. The data portion in the HTTP protocol contain the Yahoo messenger messages. This is decoded by both the server and the client.
When I try to connect to yahoo using yahoo messenger , the following processes happen in the background.
* PC gets the yahoo.com IP address from the DNS server.
* Using the yahoo IP address PC establishes a TCP connection to the yahoo server.
* Then PC sends the yahoo login message through HTTP protocol.
A sample HTTP protocol and yahoo messenger protocol message captured through ethereal is shown below
The yahoo messenger protocol is the data portion of the HTTP protocol. The yahoo messenger protocol starts with the header YMSG.
| 59 4D 53 47 | YMSG, yahoo messenger protocol message starts |
| 00 0e 00 00 | Version, yahoo messenger version is 14 |
| 00 25 | Length, packet length 37 bytes or 0x25 bytes |
| 00 57 | Yahoo Service, service in this case is YAHOO_SERVICE_AUTH |
| 00 00 00 00 | Yahoo Status , Status of the using trying to login in this case is YAHOO_STATUS_AVAILABLE |
| 7a 40 00 00 | Yahoo Session ID, Session id of the client and server. Followed by the data |
Yahoo messenger protocol background process using ethereal The following explains a simple communication between the yahoo client and yahoo server . In this case client A send a message to client B, where client B is offline. Each process is explained with packet capture using ethereal.

#### Login process
##### Client A log in to yahoo messenger.

1. When client A submits the login button of the yahoo messenger with his user id and password the following happens between the client ( Client A yahoo messenger) and yahoo server. Client A says I want to login as <username> here is the session id ‘7a 40 00 00’ and user name pusuku
7a 40 00 00 is the session id, Client sents a YAHOO_SERVICE_AUTH (00 57) with status YAHOO_STATUS_AVAILABLE(00 00 00 00)
2. Server responds , Okay , Here is a challenge string , Using this to hash your id and password and send it to me
Server responds with YAHOO_SERVICE_AUTH (00 57) and status YaHOO_STATUS_BRB and the challenge string in the data portion of the yahoo messenger protocol
3. Client says, here is the user id and password hashed with the challenge string
Client sends a YAHOO_SERVICE_AUTHRESP (00 54) with user and password hashed with the challenge string , The hashed challenge string is sent as data portion
4. Server verifies the user id and password and responds , okay your authenticated , here is your buddy list
Server on authentication responds with the buddy list YAHOO_SERVICE_LIST (00 55) With this Client A is ready is ready to send the message to Client B , Tough client A knows , Client B is offline client A sends a offline message .

#### Send process

As Client A select Client B window and start typing, 1. The Client says , I am typing message for my buddy
client sends YAHOO_SERVICE_NOTIFY(00 4b) message saying pusuku is sending message to dnunai with the status YAHOO_SERVICE_TYPING (0x16)
2. When the user presses the send button . The client sends the message to the server client send this message <msg> to my buddy <buddyname> server
client sends YAHOO_SERVICE_MESSAGE(00 06) message to the server The server processes the message , The message is from pusuku to dnunai(who’s status is offline, 5a 55 aa 56) Note the message sent ‘ hi kella’ Since Client B is offline , the server stores the message and sends it to client B , when client B log in. Now, client A has sent the message, time to logout.

#### Logout process

1. Client A says , I am done , I am logging out .
client sends YAHOO_SERVICE_LOGOFF(00 02) message to server
2. Server responds , okay .
Server responds with empty message with service YAHOO_SERVICE_LOGOFF

### Understanding Tracert with Ethereal

Tracert is a windows based tool for tracing the path of the packets taken from your pc to the destination router. This assignment traces the path from my pc to www.yahoo.com using Tracert
The above output from tracert shows the number of routes it took, name of the routers on the way and time taken to reach each router. It took 14 hops to reach the yahoo server from my pc. The asterisk indicate the failed attempt for next route.
When I executed the command ‘tracert www.yahoo.com’ the following happens in the back ground. The packets were captured using ethereal.
Step 1: The PC sends a DNS request to the DNS server to resolve the ip address of yahoo.com.
Step 2: After getting yahoo.com ip address , tracert sends icmp echo request message with TTL set to 1, Each echo request is received by the router at the first hop , which responds with ‘time to live exceeded live‘ message. Each hop packets are analyzed below .

#### Hop 1

| 45 | = IP version 4 |
| 01 | = TTL (time to live ) |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code , net unreachable |
| 45 | = IP version 4 |
| 40 | = TTL (time to live ) => 64 |
| 01 | = ICMP protocol |
| 18 06 66 d4 | = Source ip address = > 24.6.102.212 |
| C0 a8 01 65 | = Destination ip address = > 192.168.1.101 |
| 0b | = Type ICMP => 11 (time to live exceeded |
| 00 | = Code , net unreachable (time to live exceeded in transit) |
| 45 | = IP version 4 |
| 01 | = TTL (time to live ) |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code , net unreachable |
| 45 | = IP version 4 |
| 40 | = TTL (time to live ) => 64 |
| 01 | = ICMP protocol |
| 18 06 66 d4 | = Source ip address = > 24.6.102.212 |
| C0 a8 01 65 | = Destination ip address = > 192.168.1.101 |
| 0b | = Type ICMP (Echo (ping) request) => 11 (time to live exceeded |
| 00 | = Code , net unreachable (time to live exceeded in transit) |
| 45 | = IP version 4 |
| 01 | = TTL (time to live ) |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code , net unreachable |
| 45 | = IP version 4 |
| 40 | = TTL (time to live ) => 64 |
| 01 | = ICMP protocol |
| 18 06 66 d4 | = Source ip address = > 24.6.102.212 |
| C0 a8 01 65 | = Destination ip address = > 192.168.1.101 |
| 0b | = Type ICMP (Echo (ping) request) => 11 (time to live exceeded |
| 00 | = Code , net unreachable (time to live exceeded in transit) |

#### Hop 2

| 45 | = IP version 4 |
| 02 | = TTL (time to live ) => 2 |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code , net unreachable |
| 45 | = IP version 4 |
| 02 | = TTL (time to live ) => 2 |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code , net unreachable |
| 45 | = IP version 4 |
| 02 | = TTL (time to live ) => 2 |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code , net unreachable |

#### Hop 3

| 45 | = IP version 4 |
| 03 | = TTL (time to live ) => 3 |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code , net unreachable |
| 45 | = IP version 4 |
| fd | = TTL (time to live ) => 253 |
| 01 | = ICMP protocol |
| 44 57 c6 69 | = Source ip address = > 68.87.198.105 |
| a8 01 65 | = Destination ip address = > 192.168.1.101 |
| 0b | = Type ICMP (Echo (ping) request) => 11 (time to live exceeded |
| 00 | = Code , net unreachable (time to live exceeded in transit) |
| 45 | = IP version 4 |
| 03 | = TTL (time to live ) => 3 |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code, net unreachable |
| 45 | = IP version 4 |
| 03 | = TTL (time to live ) => 3 |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code, net unreachable |

#### Hop 4

| 45 | = IP version 4 |
| 04 | = TTL (time to live ) => 4 |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code, net unreachable |
| 45 | = IP version 4 |
| fd | = TTL (time to live ) => 253 |
| 01 | = ICMP protocol |
| 44 57 c0 1a | = Source ip address = > 68.87.192.26 |
| c0 a8 01 65 | = Destination ip address = > 192.168.1.101 |
| 0b | = Type ICMP (Echo (ping) request) => 11 (time to live exceeded |
| 00 | = Code , net unreachable (time to live exceeded in transit) |
| 45 | = IP version 4 |
| 04 | = TTL (time to live ) => 4 |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code, net unreachable |
| 45 | = IP version 4 |
| fd | = TTL (time to live ) => 253 |
| 01 | = ICMP protocol |
| 44 57 c0 1a | = Source ip address = > 68.87.192.26 |
| c0 a8 01 65 | = Destination ip address = > 192.168.1.101 |
| 0b | = Type ICMP (Echo (ping) request) => 11 (time to live exceeded |
| 00 | = Code , net unreachable (time to live exceeded in transit) |
| 45 | = IP version 4 |
| 04 | = TTL (time to live ) => 4 |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code, net unreachable |

#### Hop 5

| 45 | = IP version 4 |
| 05 | = TTL (time to live ) => 5 |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code, net unreachable |
| 45 | = IP version 4 |
| fd | = TTL (time to live ) => 252 |
| 01 | = ICMP protocol |
| 44 57 c0 22 | = Source ip address = > 68.87.192.34 |
| c0 a8 01 65 | = Destination ip address = > 192.168.1.101 |
| 0b | = Type ICMP (Echo (ping) request) => 11 (time to live exceeded |
| 00 | = Code , net unreachable (time to live exceeded in transit) |
| 45 | = IP version 4 |
| 05 | = TTL (time to live ) => 5 |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code, net unreachable |
| 45 | = IP version 4 |
| 05 | = TTL (time to live ) => 5 |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code, net unreachable |
| 45 | = IP version 4 |
| fd | = TTL (time to live ) => 252 |
| 01 | = ICMP protocol |
| 44 57 c0 22 | = Source ip address = > 68.87.192.34 |
| c0 a8 01 65 | = Destination ip address = > 192.168.1.101 |
| 0b | = Type ICMP (Echo (ping) request) => 11 (time to live exceeded |
| 00 | = Code , net unreachable (time to live exceeded in transit) |

#### Hop 6

| 45 | = IP version 4 |
| 06 | = TTL (time to live ) => 6 |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code, net unreachable |
| 45 | = IP version 4 |
| 06 | = TTL (time to live ) => 6 |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code, net unreachable |
| 45 | = IP version 4 |
| 06 | = TTL (time to live ) => 6 |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code, net unreachable |

#### Hop 7

| 45 | = IP version 4 |
| 07 | = TTL (time to live ) => 7 |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code, net unreachable |
| 45 | = IP version 4 |
| F8 | = TTL (time to live ) => 248 |
| 01 | = ICMP protocol |
| 44 57 c0 22 | = Source ip address = > 12.118.38.5 |
| c0 a8 01 65 | = Destination ip address = > 192.168.1.101 |
| 0b | = Type ICMP (Echo (ping) request) => 11 (time to live exceeded |
| 00 | = Code , net unreachable (time to live exceeded in transit) |

#### Hop 14

| 45 | = IP version 4 |
| 0e | = TTL (time to live ) => 14 |
| 01 | = ICMP protocol |
| c0 a8 01 65 | = Source ip address = > 192.168.1.101 |
| d1 83 24 9e | = Destination ip address = > 209.131.36.158 |
| 08 | = Type 8 ICMP (Echo (ping) request) |
| 00 | = Code, net unreachable |
| 45 | = IP version 4 |
| 33 | = TTL (time to live ) => 51 |
| 01 | = ICMP protocol |
| D1 83 24 9e | = Source ip address = > 209.131.36.158 |
| c0 a8 01 65 | = Destination ip address = > 192.168.1.101 |
| 00 | = Type ICMP (Echo (ping) reply => 0 |
| 00 | = Code |
The above reply indicates the destination, www.yahoo.com . Thus tracert tool can be used to troubleshooting the network and finding the path of the network .

### Conclusion

Ethereal is a powerful tool to capture and analyze many networking protocols. It does not detect or solve any network problem by itself but it can always be used to do so. It gives all the relevant details for any communication so it is used in research work and other relevant fields.

### Questions and Answers

Q1. What is the value for ICMP protocol message
a. 0x10
b. 10
c. 0x01
d. 1
Ans: a, 0x10
Q2. How does yahoo messenger protocol header start ? a. YHOO
b. YMSG
c. YCHT
d. No such yahoo messenger protocol
Ans: b, YMSG
Q3. Study the following figure Ethereal capture shown below:
1. What is the selected message(no: 18) all about?
Answer: the sync message is the first message sent from the client to the server as the first message in of the three way handshake protocol in order to establish the connection with the server. The sync message establishes the connection and synchronizes the client and the server. The server then sends the acknowledgement signal.
2. What is the four tuple of this communication? Answer: Four tuple of any exercise is source IP, source port no: and destination IP, destination port no:. for this communication the four tuple would be:
* 192.168.1.76, 1942
* 203.84.221.151, 80