# Wireshark/LLMNR

Wireshark is a free and open source packet analyzer used for network troubleshooting and analysis. These activities will show you how to use Wireshark to capture and analyze Link-Local Multicast Name Resolution (LLMNR) traffic.

## Readings

* Wikipedia: Link-local Multicast Name Resolution

## Preparation

To prepare for this activity:
* Start Windows.
* Log in if necessary.
* Install Wireshark.

## Activity 1 - Capture LLMNR Traffic

To capture LLMNR traffic:
* Start a Wireshark capture.
* Open a command prompt.
* Type ping <unknown>, where <unknown> is any unknown host name on your network. An unknown host name is used for this activity because names resolved by DNS will not generate LLMNR traffic.
* Close the command prompt.
* Stop the Wireshark capture.

## Activity 2 - Analyze LLMNR IPv6 Traffic

To analyze LLMNR IPv6 traffic:
* Observe the traffic captured in the top Wireshark packet list pane. To view only LLMNR traffic, type udp.port == 5355 (lower case) in the Filter box and press Enter.
* Select the first LLMNR packet labeled Standard query.
* Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 6 / User Datagram Protocol / Link-local Multicast Name Resolution (query) frame.
* Expand Ethernet II to view Ethernet details.
* Observe the Destination and Source fields. The destination should be the LLMNR IPv6 multicast MAC address 33:33:00:01:00:03 and the source should be your MAC address. You can use ipconfig /all and netsh interface ipv6 show neighbors to confirm.
* Expand Internet Protocol Version 6 to view IPv6 details.
* Observe the Source address. Notice that the source address is your link-local IPv6 address.
* Observe the Destination address. Notice that the destination address is the LLMNR multicast IPv6 address ff02::1:3.
* Expand User Datagram Protocol to view UDP details.
* Observe the Source port. Notice that it is a dynamic port selected for this LLMNR query.
* Observe the Destination port. Notice that it is llmnr (5355).
* Expand Link-local Multicast Name Resolution (query) to view LLMNR details.
* Expand Flags to view flags details.
* Expand Queries to view query details.
* Observe the query generated.

## Activity 3 - Analyze LLMNR IPv4 Traffic

To analyze LLMNR IPv4 traffic:
* Observe the traffic captured in the top Wireshark packet list pane. To view only LLMNR traffic, type udp.port == 5355 (lower case) in the Filter box and press Enter.
* Select the second LLMNR packet labeled Standard query.
* Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 4 / User Datagram Protocol / Link-local Multicast Name Resolution (query) frame.
* Expand Ethernet II to view Ethernet details.
* Observe the Destination and Source fields. The destination should be the LLMNR IPv4 multicast MAC address 01:00:5e:00:00:fc and the source should be your MAC address. You can use ipconfig /all and arp -a to confirm.
* Expand Internet Protocol Version 4 to view IPv4 details.
* Observe the Source address. Notice that the source address is your IPv4 address.
* Observe the Destination address. Notice that the destination address is the LLMNR multicast IPv4 address 224.0.0.252.
* Expand User Datagram Protocol to view UDP details.
* Observe the Source port. Notice that it is a dynamic port selected for this LLMNR query.
* Observe the Destination port. Notice that it is llmnr (5355).
* Expand Link-local Multicast Name Resolution (query) to view LLMNR details.
* Expand Flags to view flags details.
* Expand Queries to view query details.
* Observe the query generated.
* Close Wireshark to complete this activity. Quit without Saving to discard the captured traffic.