Resolution: This can be easy to forget and miss. Issue: There are no HTTP packets in the packet capture, even though the browser sent an HTTP GET REQEUST and we received the HTTP GET RESPONSE This doesn’t make sense, there are no HTTP packets all. Resolution: Since we are accessing a web page using HTTP, we can filter Wireshark on http so let’s do that. So, even though we pinged the domain, it’s not necessarily the IP of the HTTP host. IP Addresses are allocated on demand and as demand changes so does the specific resource.
This is the nature of the cloud where IP Addresses are not static and are loosely coupled to services.
Issue: The AWS S3 Address 52.217.41.164 is not found in the capture file. Note that the AWS S3 address, in this case, is not static and can change. Let’s get the IP address of my local Gateway.Īt this point, we have 3 IP Addresses that will be helpful to analyze the packet flow and we expect to find these addresses in the Wireshark capture. This means that we go through a NAT device, and of course the NAT is occurring on my local WiFi Gateway. However, 192.168.1.206 is a private RFC 1918 address so it’s not routable. So now we should expect to see captured packets that show communication between 192.168.1.206 and 52.217.41.164. Let’s also get the IP Address of the AWS S3 hosted website. Run the command ifconfig to get the local IP address. So, we need some clues and be able to use the Wireshark filter capabilities to find the relevant IP Addresses. Since I got 196 packets captured, it’s not that simple to identify the packets that we want to analyze versus the other noise. Save the pcap file so that we have a backup in case we screw up the traffic capture. So, we’ll have to dig into the capture to find the relevant IP Addresses.
That’s it, nothing else.ģ) Do these steps in order and as quick as possible. I’m using wireless so the capture filter on my MacBook Air is en0. Local network traffic is very noisy so I’ll hit enter just after I start Wireshark.Ģ) Load up Wireshark and setup the capture filter. Packet Captureġ) Paste in the website location into my browser, using Chrome, but don’t hit enter yet. In case you haven’t captured traffic before, it’s a pretty easy process that I outline below, otherwise you can skip to the analysis. I wanted to see what a packet flow looks like to a website hosted on AWS so I uploaded a simple HelloWorld website to AWS S3, an object store that is great for hosting simple, static websites, and captured packets working from my home “office”.
0 kommentar(er)
