Steps to observe packet spoofing by ISPs (2)

Market Intelligence:

Running the test: Start Wireshark (with administrative privileges, e.g. root privileges, sufficient to perform a raw packet capture 8). Select “Interfaces” from the “Capture” menu.

Choose the interface corresponding to the network device you will use to capture packets; the IP addresses bound to all available network interfaces are displayed, which may help you distinguish them if you are unsure which network interface is which.

Click the Options button for the correct interface.

In the Capture Options dialogue, ensure that the IP address you expected your computer to be using is displayed in the “IP address” field.

We recommend setting a capture filter to ensure that only packets directly to or from the other computer will be captured.

If the other computer’s IP address is 4.8.16.32, a suitable capture filter string is “host 4.8.16.32”.

We also recommend setting “Update list of packets in real time” and “Automatic scrolling in live capture”, which help you watch the capture process while it’s underway, unless your computer is too slow.

Wireshark screenshot:

When you’re ready to begin capturing packets, click the Start button.

If you’ve set a capture filter to limit capturing to traffic to or from the other computer, you will probably not see any packets appear in the capture until you deliberately generate some traffic between the two computers.

To ensure that the traffic is showing up, you should ensure that Wireshark packet captures are running at both ends, and then have one computer ping the other computer by IP address.

This generates a steady stream of ICMP echo request and echo reply packets.

ITREALMS Online ... delivering news for ICT4D