Analysis Of Performance And Deployment Issues For Networked Applications Using Wireshark

This assignment is designed to develop deeper analytical understanding of different distributed network conditions. At the completion of this assessment students should be able to:

a. Analyse performance and deployment issues for networked applications;

b. Compare appropriate industry tools and techniques to manage networked applications;

Network 1

The report is prepared for the analysing and comparing the performance of two websites https://www.abc.net.au/news/, https://iview.abc.net.au/ using wireshark. The different network issues and the networked application that can be used for analysing the system performance are identified and improving the quality of service. A research is made on the usability of wireshark for identification of the networking protocol and analysing the flow of data traffic in the network. Different network is used for analysing the performance of the website and identification of the vulnerability acting on the system using wireshark. It helps in identification of the packet loss and the IP address of the client and server. The quality of service that can be achieved using the wireshark application is analysed by analysing the name resolution-network address, retransmission and the packet loss during surfing the website. The packet loss is identified from the generation of the throughput graph and application of tcp.analysis.lost_segment filter in wireshark. The statistics collected from wireshark is collected and compared with each other for the identification of the network performance. Along with wireshark Microsoft Message Analyzer is used and its usability is compared by analysing its ease of access, GUI, visualization of traffic and statistics generation.

1. Start time of capture

The start time of capture of the data packet is Jan 20, 2019 13:14:42.464581000.

2. Total number of capture packet for each protocol

The total number of captured packet for the first pcap file is 2190 packets

3. Total Number of lost packets

0 packet is lost while connecting with the two website and it is analysed by applying the filter tcp.analysis.lost_segment in the wireshark packet capture file.

4. IP addresses of the client and server

The IP address of the source machine is 10.10.30.142 and the Ip address of the destination server is 8.8.8.8.

1. Start time of capture

The start time for capturing the data packet flowing in the network is identified from the time section of summary and it is given below:

Time

First packet: 2019-01-20 14:32:43

Last packet: 2019-01-20 14:33:24

Elapsed: 00:00:41

2. Total number of capture packet for each protocol

The total number of packet captured from each of the protocol is identified from the summary report generated from wireshark and it can be found under the statistics section.

3. Total Number of lost packets

0 number of packets are lost in the network and it is identified from the interface section of the pcap summary report generated in wireshark.  

4. IP addresses of the client and server

The following is the Ip address of the client and server Internet Protocol Version 4, Src: 172.30.4.46, Dst: 8.8.4.4 identified from the packet captured from the second network.

1. Start time of capture

The start time of capturing the packet is given below:

First packet:

2019-01-20 14:34:59

Last packet:

2019-01-20 14:35:39

Elapsed:

00:00:39

2. Total number of capture packet for each protocol

The total number of packets captured can also be found from the wireshark summary and it is given below:

Packets

5889

3. Total Number of lost packets

The number of packets lost in the network is unknown and it is needed to be analysed for the pcap file captured using the wireshark.

4. IP addresses of the client and server

The IP address of the source and destination address is Internet Protocol Version 6, Src: 2404:a800:0:14::1:1010 (2404:a800:0:14::1:1010), Dst: 2401:4900:314e:a39d:c93:ea02:b17c:8bd1 (2401:4900:314e:a39d:c93:ea02:b17c:8bd1).

1. Name Resolution-Network Address

For displaying the resolution-network address the view option is selected and from there the Resolve network Addresses is checked for displaying the network addresses instead of the physical addresses.  

2. Retransmission

Network 2

For displaying the packets retransmitted in the network the filter tcp.analysis.retransmission is applied in the packet captured and it shows that none of the packet is retransmitted since no packet is lost in the network.

3. Packet Loss

0 packet is lost while connecting with the two website and it is analysed by applying the filter tcp.analysis.lost_segment in the wireshark packet capture file.

Network 2

1. Name Resolution-Network Address

For displaying the resolution-network address the view option is selected and from there the Resolve network Addresses is checked for displaying the network addresses instead of the physical addresses.  

2. Retransmission

For displaying the packets retransmitted in the network the filter tcp.analysis.retransmission is applied in the packet captured and it shows that packet number 717, 1662, 1821, 2487 and 3202 is retransmitted since packet are lost in the network.

3. Packet Loss

1 packet is lost while connecting with the two website and it is analysed by applying the filter tcp.analysis.lost_segment in the wireshark packet capture file.

Network 3

1. Name Resolution-Network Address

For displaying the resolution-network address the view option is selected and from there the Resolve network Addresses is checked for displaying the network addresses instead of the physical addresses.  

2. Retransmission

For displaying the packets retransmitted in the network the filter tcp.analysis.retransmission is applied in the packet captured and it shows that 86 number of packet is retransmitted since there is packet lost in the network and the network is unstable.

3. Packet Loss

35 packet is lost while connecting with the two website and it is analysed by applying the filter tcp.analysis.lost_segment in the wireshark packet capture file. The increase in packet loss in the network increases the need of retransmission of data packet in the network.

A comparison is made on the by running the two website application is three different network and it is found the first network is more stable when compared with the other two networks. No data packets are lost in the first network and thus there is no need of retransmission of data packet and thus less number of data traffic is generated in the network. The second network is less stable than the first network and it is an open network and is vulnerable to different types of attacks. The third network is a home network and unstable and has more packet loss and needs more retransmission of data packets. For the analysis of the performance of the network a throughput graph is generated from the pcap file that shows its stability and the tcp.analysis.retransmission filter is applied for the generation of the network retransmission graph.

Since there are no packet loss and data retransmitted in the network the network is considered as a stable network and no graph can be generated for the retransmitted data packet.

Throughput Graph

The following throughput graph is generated from the pcap file for the lost packet in the network

From the above graph it is identified that the maximum throughput of the network is of around 1400 bytes and it is displayed for a segment of 0 to 1400 byte length.

Network 3

Network Retransmission Statistics

From the above network retransmission statistic graph it is identified that the network is stable and the number of sequence flows from 7000 for a time span of 17.5 second.

Throughput Graph

The following throughput graph is generated from the pcap file for the lost packet in the network

From the above graph it is identified that the maximum throughput of the network is of around 1200 bytes and it is displayed for a segment of 0 to 1300 byte length. The interval is 100 bytes of for the segment length .

The network 3 is considered as unstable since there is more number of packet loss and the graph also shows fluctuation during retransmitting the packets. 

Microsoft Message Analyzer and the wireshart is compared with each other and the comparison is made based on its ease of access and use, GUI, visualisation of traffic and statistics generation.

Wireshark is an open source software that is freely available to the user and its size is smaller than Microsoft message Analyzer. It also needs less PC resources for running than the Microsoft Message analyser. The minimum requirement for running wireshark is 500 mhz processor, 512 mb RAM and 80 mb HDD space. It is compatible with other network application and used by the network administrator for the management of network.

GUI – 

The GUI of Microsoft message analyser is more enhanced and usable than wireshark a detailed step is needed to be passed for reaching the final step in message analyser while the user can generate or apply different filter to get the output from the packet. There are certain options that are not available in wireshark but in message analyser the user can use the option to generate the output.

Visualization of the traffic – 

The data traffic flowing in the network can be viewed with the details such as protocols, information, length, source address, destination address and the sections can be expanded for getting more details from the network. The traffic is shown in different panes and the user can select a packet and expand it for getting its details.

Statistics generation – 

Reports about the network can be generated using Microsoft message analyser and different network components can be tested. It is used as a technical tool for management of the access of the resources and eliminate the risk associated with the network. The tool can be used for generating statistical report and eliminate the vulnerability of different types of network attack.

Conclusion

From the above report it can be concluded that for analysing the performance of the website and the network wireshark is used. It is an open source tool that is used for identification of the network vulnerability and generation of statistical report that is used for identification of the details of source and destination. The vulnerability of the network can be analysed by capturing live data packet from the network and analysing the different protocols and the IP address used by the source and the client and the time taken to reach the destination address. The unknown sources can be identified from the captured packets and the vulnerabilities acting on the network should be identified. The number of hops acting on the network should be identified for configuring the network according to the needs. The traffic in the network can be visualized and the access of usage of the network should be managed and the interface used for the capturing the data packet should be selected for capturing the data packet from the network. The use of different network to reach the network helps in generating an average result for identification of packet loss and retransmissions. 

References

Benton, A., Arora, R. and Dredze, M. Learning multiview embeddings of twitter users. In Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers)(Vol. 2, pp. 14-19)., 2016.

Cuppens, F. WirelessHART NetSIM: A WirelessHART SCADA-Based Wireless Sensor Networks Simulator. In Security of Industrial Control Systems and Cyber Physical Systems: First Workshop, CyberICS 2015 and First Workshop, WOS-CPS 2015 Vienna, Austria, September 21–22, 2015 Revised Selected Papers(Vol. 9588, p. 63). Springer., 2016, June.

Nayak, P. and Sinha, P. Analysis of Random Way Point and Random Walk Mobility Model for Reactive Routing Protocols for MANET Using NetSim Simulator. In Artificial Intelligence, Modelling and Simulation (AIMS), 2015 3rd International Conference on(pp. 427-432). IEEE., 2015 December.

Peng, J., Li, H., Wang, Y. and Chen, J. A web tool for measuring gene semantic similarities by combining Gene Ontology and gene co-function networks. In Proceedings of the 6th ACM Conference on Bioinformatics, Computational Biology and Health Informatics(pp. 678-679). ACM., 2015 September.

Saifuddin, K.M., Ahmed, A.S., Reza, K.F., Alam, S.S. and Rahman, S. Performance analysis of cognitive radio: Netsim viewpoint. In Electrical Information and Communication Technology (EICT), 2017 3rd International Conference on(pp. 1-6). IEEE., 2017 December.

Singh, G. and Singh, H. Performance Evaluation of MANET Routing Protocols using NETSIM. i-Manager's Journal on Information Technology, 6(1), p.8., 2016.

Singh, G., Cheema, A.K. and Kapoor, N. Performance Evaluation of Routing Protocol in Internet of Things using Netsim. International Journal, 8(3)., 2017.

Chappell, L. Wireshark 101: Essential Skills for Network Analysis-Wireshark Solution Series. Laura Chappell University., 2017.

Sanders, C. Practical packet analysis: Using Wireshark to solve real-world network problems. No Starch Press., 2017.

Ndatinya, V., Xiao, Z., Manepalli, V.R., Meng, K. and Xiao, Y. Network forensics analysis using Wireshark. International Journal of Security and Networks, 10(2), pp.91-106., 2015.

Walnycky, D., Baggili, I., Marrington, A., Moore, J. and Breitinger, F. Network and device forensic analysis of android social-messaging applications. Digital Investigation, 14, pp.S77-S84., 2015.

Messier, R. Packet Capture and Analysis. Network Forensics, pp.81-112., 2017.

Cappers, B.C. and van Wijk, J.J. Semantic Network Traffic Analysis using Deep Packet Inspection and Visual Analytics., 2017.

Quadrio, G., Bujari, A., Palazzi, C.E., Ronzani, D., Maggiorini, D. and Ripamonti, L.A. Network analysis of the steam in-home streaming game system: poster. In Proceedings of the 22nd Annual International Conference on Mobile Computing and Networking (pp. 475-476). ACM., 2016, October.