Wireshark and

Cisco Network
Assistant

Mark Anderson
Mesa Community College

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 1
 What Are We Covering Today?

ƒ Wireshark
Getting started
Capturing PDUs
What is all this Stuff?
Check out the VODs

ƒ Cisco Network Assistant

Getting started
Discovering the Network
What else can I do?

ƒ Time to play

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 2
 Wireshark

Subtitle

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 33
 What Is Wireshark?
(Formerly Ethereal)

ƒ Wireshark is the world's foremost network protocol

analyzer, and is the de facto (and often de jure)
standard across many industries and educational
institutions
ƒ Wireshark development thrives thanks to the
contributions of networking experts across the globe
ƒ It is the continuation of a project that started in 1998
Translation: You can capture Packet Data
Units (PDU) and analyze them

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 4
 Getting Started

ƒ Download www.wireshark.org
Note: Wireshark 1.00 was released May 28, 2008, many
security-related vulnerabilities have been fixed

ƒ Install on host computer

ƒ Connect host to Network via Fast Ethernet
ƒ When connected to a switch only unicast packets
destined to the host, as well as multicast and
broadcast, will be captured
ƒ Launch Wireshark

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 5
 Launching Wireshark

Capture Æ Options

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 6
 Setting Options

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 7
 Generating ARP Traffic

Generate ARP Traffic:

1. Bring up a command prompt (Start Æ Run Æ cmd )
2. Enter arp –d to clear the arp cache
3. Ping the broadcast for the local subnet
Example: ping 192.168.1.255

4. Enter arp –a to verify arp translations are in arp cache

See Next Slide Æ

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 8
 Generate ARP Traffic

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 9
 Capturing PDUs

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 10
 See What Was Captured

Packet List Pane

Packet Details Pane

Packet Bytes Pane

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 11
 Analyze an ARP Request

Notice the Target

MAC Is Unknown

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 12
 Analyze an ARP Reply

Notice the MAC is known

(Target is now the sender)

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 13
 Generating TCP 3-Way Handshake Traffic

Generate TCP Traffic Using a Browser:

1. From the Host, bring up a browser
2. In the Address field, enter the IP address of any device
on the network that has an IP address and http server
enabled, such as a router, switch, webserver, Discovery
server, or Eagle server
Note: on router Æ router(config)#ip http server

3. Once the browser brings up the home page of the device,

you can stop the capture

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 14
 TCP 3-Way Handshake
Look for Three TCP

1st Packet

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 15
 TCP 3-Way Handshake

2nd Packet

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 16
 TCP 3-Way Handshake

3rd Packet

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 17
 Flow Graph

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 18
 Additional Resources

ƒ VODs found on the Academy site under:

Interactive Course Guides Æ Media Archive

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 19
 Additional Resources

Wireshark Labs:
ƒ Discovery 2 Æ Lab 8.3.2 Conducting a Network Capture
with Wireshark
ƒ *Discovery 3 Æ Lab 1.2.2 Capturing and Analyzing
Network Traffic
ƒ Discovery 4 Æ Lab 1.4.3 Monitoring VLAN Traffic
ƒ Exploration 1 Æ 2.6.2, 3.4.2, 3.4.3, 4.5.2**, 4.5.3, 5.5.1,
6.7.2, 7.5.2, 9.8.1, 9.8.3, and 11.5.6

* Most informative lab in Discovery curriculum

** Great lab covering TCP 3-way handshake
BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 20
 Cisco Network
Assistant

Subtitle

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 21
21
 What Is Cisco Network Assistant?
ƒ A PC-based network management application that manages
standalone devices and clusters of devices from anywhere
in your intranet
ƒ Supports Cisco Catalyst Intelligent switches from 2950 through
4506; uses GUI to manage many critical switch functions and
launch the device manager of Cisco routers and wireless AP
ƒ Auto discovery of network devices
ƒ Topology view and front panel view
ƒ Software upgrade
ƒ Switch configuration
ƒ Perform multiple configuration tasks without using command-line
interface (CLI) commands; you can apply actions to multiple
devices and ports at the same time for VLAN and QoS, inventory
and statistics reports, link and device monitoring, software
upgrades, and many other networking features
BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 22
 Getting Started
ƒ Download from the Classroom Setup Tab on the Academy
Connection Tools page under CCNA Discovery “Designing and
Supporting Computer Networks” http://cisco.netacad.net

Note: As of June 1, 2008

the version in Tools section
is only 5.2

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 23
 Optional 1

ƒ Download
www.cisco.com
ƒ Need a CCO login
account
ƒ Present version 5.3

ƒ Install on Host Scroll Down Until You

computer See the Following:

2
BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 24
 Launch Cisco Network Assistant

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 25
 Create a Community
ƒ A community is a defined
cluster of devices grouped
by an IP address range

See next screen Æ

Select Create Community,

Then click Connect

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 26
 Name Community and
Method of Discovery
1

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 27
 Start the Discovery Process
Level 15 Authentication:
ƒ Enable: No Username
just password
ƒ Login account: Both
Username and password

Enter Start and End IP Address, Then

Click Start to Start the Discovery
Process
Note: Discovery Process Attempts to Note: Will Be Prompted
Connect to All IP Addresses in Range, for Each Device that Has
So Be Selective to Avoid Long Delays Different Authentication

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 28
 Don’t Bother Me
I’m Discovering Devices!

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 29
 Topology View

Devices Discovered
Within Range Have
Bold Connection;
Devices not in Range
Only a Line, but Can
Be Added to the
Community
BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 30
 Device Management Options
(Right Click)

How Do You Suppose This

Device Property Information
Was Obtained?
Answer: CDP Protocol

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 31
 Device Manager

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 32
 Smartports

Smartports will discovery what Cisco devices are connected

to the ports and insert a representative icon over the port,
such as a router, switch, or Cisco IP phone

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 33
 Feature Bar: Monitor Æ Reports

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 34
 Router Device Manager
ƒ Router management
is limited to what is
available on the router
ƒ Example: If SDM is on
the router, it will be
launched. If not, then
only the http server will
be launched

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 35
 Tool Bar Icons

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 36
 Additional Resources

Cisco Network Assistant Labs:

ƒ Discovery 4 Æ Lab 2.1.6 Observing Traffic Using Cisco
Network Assistant
ƒ Discovery 4 Æ Lab 2.5.2 Monitoring Network Performance
[Expands on 2.16]
ƒ Discovery 4 Æ Lab 3.1.2 Creating a Logical Network Diagram
[Students discover an unknown precabled and preconfigured network;
preferably students only have physical access to the designated
“Administrator PC”]

Note: This is the only place in both Exploration and Discovery curriculum
where Cisco Network Assistant is discussed or used in lab. Suggestion:
add it to Exploration 3 and Discovery 3 since this is where switches are
covered. If you agree this should be part of the curriculum then submit a
request to the online Help Desk.
BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 37
 LAB Topology
PC1 PC2

F0/3 F0/4

SW1
F0/1 F0/2

F0/0 F0/0
192.168.1.0/24
R1SJ R1SJ

ƒ This topology will be used for both Wireshark and

Cisco Network Assistant (CNA)
ƒ Each host can run Wireshark and also CNA
BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 38
 Alternate Lab Topology
ƒ With the addition of one more PC1 PC2
switch, this alternate topology
provides optimization of
equipment to instructors F0/3 F0/4

ƒ The top half is network SW1

F0/1 F0/2
192.168.1.0/24
192.168.1.0/24
and the bottom half F0/0 F0/0

is 10.0.0.0/24 R1SJ R1SJ

F0/1 F0/1
10.0.0.0 /24
ƒ Each host will work on their
subnet, however, it also SW1
provides flexibility to F0/3 F0/4
Optional: For Use to
expand across subnets Optimize Equipment

PC3 PC4

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 39
 Demonstration of Lab

PC1 PC2

F0/3 F0/4

SW1
F0/1 F0/2

F0/0 F0/0
192.168.1.0/24
R1SJ R1SJ

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 40
 Summary of What We Covered Today?

ƒ Wireshark
Purpose of Wireshark is a protocol analyzer that is available
to everyone to capture and analyze network traffic
We learned how to Capture PDUs and do basic analysis
Additional resources—VODs and labs in curriculum

ƒ Cisco Network Assistant (CNA)

A PC-based network management application that is used
to discover, configure, and manage Cisco devices. Critical
functions can be monitored and modified through a GUI
interface on switches and through Security Device Manager
(SDM) on newer routers
The discovery process is a feature that builds a logical
network topology of the network
BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 41
 Q and A

BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 42
42
BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 43
BRK-122T
Wireshark and Cisco Network Assistant © 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 44