Using Ethereal to Capture/Compare FTP and SFTP sesssions

Goal:
- Learn how to use Ethereal a popular network analyzer/packet sniffer to
  - capture packets,
  - understand headers/formats in different layers of protocol messages.
  - understand the sequence of message exchange of a protocol, e.g. FTP/SFTP; HTTP/HTTPS.
  - use packet filter to capture packets of interest
  - use display filter to highlight the subset of packet based on the header values, e.g. ip.addr, ftp.request.command (such as those contain passord)
- Compare packet sequences of FTP and SFTP sessions. Demonstrate that FTP (same for Telnet) are not secure.
Ethereal (current version ethereal-setup-0.99.0.exe) can be downloaded from http://www.ethereal.com/download.html
In EN149, Ethereal is installed in XPvm1, a Microsoft VPC based virtual machine. click on "My Computer", enter "C:\VirtualMachines\cs522\xpvm1" in Address box of the explorer.
Double Click on the XPvm1.vmc (virtual machine setting file). It opens a vpc window and boots windows XP system.
Enter cslab and related password (will distribut it on class mailing list). Click OK to login.

Capture packets of clear text FTP session

Double click the Cygwin icon (first icon on desktop) to open a cygwin shell windom. We will enter ftp or sftp command here when we are ready to capture the packets of ftp/sftp session.
Double click the Ethereal icon (2nd icon on desktop) to start the ethereal application.
Select Capture | Option . The following Capture Options appear. From the interface drop down list, we can select which interface to capture the packets. In our case, just choose the default one which the first Ethernet interface. Use capture filter to capture packets with certain header field values. We can speify the buffer size to limit the amount of packets capture. For display option, select "Update list of packets in real time" and "Automatic scrolling up in live capture". Check Stop Captue After 10000 packets, MB, and 1 minute. Click Start or OK.
You will see a window showing the statistics of various packet type and their volume. There is a stop button for terminating the packet capturing.
On Cygwin window, type "ftp cs.uccs.edu" command, followed with your CS Unix machine login and password.

$ ftp cs.uccs.edu
Connected to cs.uccs.edu.
220 (vsFTPd 1.2.1)
User (cs.uccs.edu:(none)): cs522p1
331 Please specify the password.
Password:XXXXX
230 Login successful.
ftp> get secret.txt
200 PORT command successful. Consider using PASV.
550 Failed to open file.
ftp> quit
221 Goodbye.
Hit the "stop" button to stop the packet capturing.
The ethereal window shows the following content:
There are many diffferent types of packet traffic. The info field show the interpreted content of the topmost layer protocol payload.
The new version of ethereal (version 0.99) comes with color filtering set. Make it easier to analyze/correlate the traffic. Older version we can manually set the color of different protocol using color filter button.
You can type in the filter expression to select packets. For example, we are interested in any packet sent to cs.uccs.edu (with ip address 128.198.162.68). We can enter "ip.addr == 128.198.162.68" in the text box on the right of the Filter button.
The following window shows a much condensed and related packets.
You can click on the msg of your interest and the detailed header info will show in the panel below. The correponding binary data in the packet will be also highlighted in the last panel.
You can ask ethereal to gather and display all related TCP payload (called stream). Select Analyze | Follow TCP Stream menuitem.
Here it shows the FTP session data collected by the Ethereal. It is very powerful tool for analyzing the packet sequence of a protocol and an effective learning tool.
You can click on the button with color palete for specifying the color rules. The following Coloring Rule dialog appeas.
Select "new" to create new one.
Here is the new/Edit Color Filter dialog. Enter the name "ftp" and string "tcp.dstport==21" There are Foregrond/Background Color buttons for selecting the colors.
To asist the specify the pattern of the packets that will be colored. Click the +Expression button. It provides selection menus for constructing the expression.
Select File | Save as to save the captured packets to a file. Choose the S:. and file name ftpsession.pcap.
Experiment with the specification of the packet filters and coloring filters.
Close and exit the Ethereal window.
Use cygwin shell window to scp the file to your CS Unix machine cs522 web site.

Capture packets of secure SFTP session

Follow the previsou setion to set up Ethereal for capturing an SFTP session.
On Cygwin shell window, type "sftp cs522p1@cs.uccs.edu", confirm the server public key, type password, type "get secret.txt", then "quit".
The following shows the captured SFTP packets.
The highlight packet is a encrypt key exchange mesage from the client XPvm1 to cs.uccs.edu.
The following shows the FTP session data is encrypted.
Note we did not even know this is a file transfer session.
Even the packets got intercepted. It is very very difficlut to decrypt the content.
The following two are capatured HTTP and HTTPS sessions
Secure HTTP
You can try capture packets of telnet session to brain.uccs.edu with your ufp account. But you do not have give real password.
Try to locate the password you type in the session.
Compare that with secure shell session using cygwin shell with "ssh -l login brain.uccs.edu" command

Exit Microsoft VPC based XPvm1 virtual machine

After you finsih your exercise, hit "right alt" key (to the right of spacebar) to release the mouse. Other the mouse can not move out the XPvm1 window.
Select "Action | Close menuitem. Select "turn off and delete change" to exit quickly.
If you choose "save state and save change", it will take a long time for XPvm1 to 1) save main memory image (called state; similar to what being saved when a laptop standby) and merge its undo drive (temporary) file to virtual disk file.