Chapter 6 Hands-On Project 6-1 View ICMPv6 Neighbor Discovery Messages Time Required: 10 minutes Objective: Use Wireshark to view a trace file and configure filters to view ICMPv6 Neighbor Discovery messages. Description: This project shows you how to use Wireshark to configure specific filters using a supplied trace file and view individual Neighbor Discovery messages. The use of filters allows for easier and often quicker viewing of a specific component in large trace files and/or real-time capturing of data. You will find and view Router Solicitation, Router Advertisement, Neighbor Solicitation, and Neighbor Advertisement messages. 1. 1. Start Wireshark. (In Windows 7, click the Start button, point to All Programs, and then click Wireshark. In Windows 10, click the Start button, click All apps, and then scroll down and click Wireshark.) 2. 2. Click File on the menu bar, click Open, select the ch06_Handson_Project_trace_file.pcapng file, and click Open. 3. 3. In the Filter Toolbar, type icmpv6.type == 133 in the field where it says “Apply a display filter … ”. Next, select the right-facing arrow button on the right side of the Filter Toolbar to apply the filter string to the display in order to see only Router Solicitation packets in the Packet List pane. An example of the Wireshark filter configuration and output is shown in Figure 6-34. Figure 6-34 ICMPv6 Router Solicitation packet 4. 4. Select one of the packets and observe its structure. In the Packet Details pane, select the greater-than sign (>) next to Internet Control Message Protocol v6, and view the Type field. 5. 5. On the right side of the Filter Toolbar, select the “X” in order to clear the string and update the display. In the Filter Toolbar, type icmpv6.type == 134 in the field where it says “Apply a display filter … ”. Next, select the right-facing arrow button on the right side of the Filter Toolbar to apply the filter string to the display in order to see only Router Advertisement packets in the Packet List pane. 6. 6. Select one of the packets and observe its structure. In the Packet Details pane, select the greater-than sign (>) next to Internet Control Message Protocol v6 and view the Type field. 7. 7. On the right side of the Filter Toolbar, select the “X” in order to clear the string and update the display. In the Filter Toolbar, type icmpv6.type == 135 in the field where it says “Apply a display filter … ”. Next, select the right-facing arrow button on the right side of the Filter Toolbar to apply the filter string to the display in order to see only Neighbor Solicitation packets in the Packet List pane. 8. 8. Select one of the packets and observe its structure. In the Packet Details pane, select the greater-than sign (>) next to Internet Control Message Protocol v6 and view the Type field. 9. 9. On the right side of the Filter Toolbar, select the “X” in order to clear the string and update the display. In the Filter Toolbar, type icmpv6.type == 136 in the field where it says “Apply a display filter … ”. Next, select the right-facing arrow button on the right side of the Filter Toolbar to apply the filter string to the display in order to see only Neighbor Advertisement packets in the Packet List pane. 10. 10. Select one of the packets and observe its structure. In the Packet Details pane, select the greater-than sign (>) next to Internet Control Message Protocol v6 and view the Type field. 11. 11. Close Wireshark. Hands-On Project 6-2 Build a Filter to View a Neighbor Advertisement Message for a Specific Host Time Required: 10 minutes Objective: Use Wireshark to view a trace file and configure filters to view a Neighbor Advertisement message. Description: This project shows you how to use Wireshark to configure specific filters using a supplied trace file and view individual Neighbor Discovery messages. The use of filters allows for easier and often quicker viewing of a specific component in large trace files and/or real-time capturing of data. You will be configuring specific filters to view individual Neighbor Advertisement messages for a specific source host. 1. 1. Start Wireshark. (In Windows 7, click the Start button, point to All Programs, and then click Wireshark. In Windows 10, click the Start button, click All apps, and then scroll down and click Wireshark.) 2. 2. Click File on the menu bar, click Open, select the ch06_Handson_Project_trace_file.pcapng file, and click Open. 3. 3. In the Filter Toolbar, type icmpv6.type == 136 && ipv6.addr == fe80::4805:44e:b663:6c1e in the field where it says “Apply a display filter … ”. Next, select the right-facing arrow button on the right side of the Filter Toolbar to apply the filter string to the display in order to see only Neighbor Advertisement packets in the Packet List pane. An example of the Wireshark filter configuration and output is shown in Figure 6-35. Figure 6-35 ICMPv6 Neighbor Advertisement packet 4. 4. Select one of the packets and observe its structure. In the Packet Details pane, select the greater-than sign (>) next to Internet Protocol Version 6 and the greater-than sign (>) next to the Internet Control Message Protocol v6 and view the Source and Type fields. 5. 5. Close Wireshark. Hands-On Project 6-3 Build a Filter to View a Neighbor Solicitation Message for Duplicate Address Detection Time Required: 10 minutes Objective: Use Wireshark to view a trace file and configure filters to view Neighbor Solicitation messages that are for Duplicate Address Detection. Description: This project shows you how to use Wireshark to configure specific filters using a supplied trace file and view individual Neighbor Discovery messages. The use of filters allows for easier and often quicker viewing of a specific component in large trace files and/or real-time capturing of data. You will be configuring specific filters to view individual Neighbor Solicitation messages that are Duplicate Address Detection messages. 1. 1. Start Wireshark. (In Windows 7, click the Start button, point to All Programs, and then click Wireshark. In Windows 10, click the Start button, click All apps, and then scroll down and click Wireshark.) 2. 2. Click File on the menu bar, click Open, select the ch06_Handson_Project_trace_file.pcapng file, and click Open. 3. 3. In the Filter Toolbar, type icmpv6.type == 135 && ipv6.addr == :: in the field where it says “Apply a display filter … ”. Next, select the right-facing arrow button on the right side of the Filter Toolbar to apply the filter string to the display in order to see only Neighbor Solicitation packets in the Packet List pane. An example of the Wireshark filter configuration and output is shown in Figure 6-36. Figure 6-36 ICMPv6 Neighbor Solicitation packet 4. 4. Select one of the packets and observe its structure. In the Packet Details pane, select the greater-than sign (>) next to Internet Control Message Protocol v6 and view the relationship between the Target Address and the destination MAC (Ethernet II) and IPv6 addresses. 5. 5. Close Wireshark. Hands-On Project 6-4 Build a Filter to View a Router Advertisement Message That Has the M and O Flags Set Time Required: 10 minutes Objective: Use Wireshark to view a trace file and configure filters to view Router Advertisement messages. Description: This project shows you how to use Wireshark to configure specific filters using a supplied trace file and view individual Neighbor Discovery messages. The use of filters allows for easier and often quicker viewing of a specific component in large trace files and/or real-time capturing of data. You will be configuring specific filters to view individual Router Advertisement messages that have the M and O flags set. 1. 1. Start Wireshark. (In Windows 7, click the Start button, point to All Programs, and then click Wireshark. In Windows 10, click the Start button, click All apps, and then scroll down and click Wireshark.) 2. 2. Click File on the menu bar, click Open, select the ch06_Handson_Project_trace_file.pcapng file, and click Open. 3. 3. In the Filter Toolbar, type icmpv6.nd.ra.flag.m == 1 && icmpv6.nd.ra.flag.o == 1 in the field where it says “Apply a display filter … ”. Next, select the right-facing arrow button on the right side of the Filter Toolbar to apply the filter string to the display in order to see only Router Advertisement packets in the Packet List pane. An example of the Wireshark filter configuration and output is shown in Figure 6-37. Figure 6-37 ICMPv6 Router Advertisement packet 4. 4. Select one of the packets and observe its structure. In the Packet Details pane, select the greater-than sign (>) next to Internet Control Message Protocol v6 and also select the greater-than sign (>) next to Flags, and view the settings for the Managed address configuration and Other configuration options. 5. 5. Close Wireshark. Hands-On Project 6-5 Build a Filter to View a Router Advertisement Message That Has Prefix Information Time Required: 10 minutes Objective: Use Wireshark to view a trace file and configure filters to view Router Advertisement messages. Description: This project shows you how to use Wireshark to configure specific filters using a supplied trace file and view individual Neighbor Discovery messages. The use of filters allows for easier and often quicker viewing of a specific component in large trace files and/or real-time capturing of data. You will be configuring specific filters to view individual Router Advertisement messages that have the Prefix option included and the Onlink flag set. 1. 1. Start Wireshark. 2. 2. Click File on the menu bar, click Open, select the ch06_Handson_Project_trace_file.pcapng file, and click Open. 3. 3. In the Filter Toolbar, type icmpv6.opt.type == 3 in the field where it says “Apply a display filter … ”. Next, select the right-facing arrow button on the right side of the Filter Toolbar to apply the filter string to the display in order to see only Router Advertisement packets in the Packet List pane. An example of the Wireshark filter configuration and output is shown in Figure 6-38. Figure 6-38 ICMPv6 Router Advertisement packet 4. 4. Select one of the packets and observe its structure. In the Packet Details pane, select the greater-than sign (>) next to Internet Control Message Protocol v6, select the greater-than sign (>) for the ICMPv6 Option (for Prefix), and select the greater-than sign (>) next to Flags, and view the setting for the On-link flag (L) option. 5. 5. Close Wireshark. Case Project 6-1 Understanding Neighbor Solicitation and Neighbor Advertisement Messages In preparing for an IPv6 implementation at your company, you are responsible for providing basic IPv6 operations information to the desktop support team. One of the topics in your document is to describe the overall functions of Neighbor Discovery operations, specifically Neighbor Solicitation and Neighbor Advertisement messages and what they provide an IPv6 node on the network. Detail the components these two ND processes provide and also provide the specific Wireshark display filter required to quickly view these processes when capturing network traffic. Case Project 6-2 Troubleshooting a Specific Network Problem You are called to assist in troubleshooting a network problem that has occurred soon after a significant IPv6 implementation. Some network hosts seem to have network access, but their browsers do not resolve URLs that are entered. The network technicians troubleshooting the problem have discovered that the hosts in question can ping other network hosts on a different network segment, but only via IPv6 addresses. Hosts on the other network segment can resolve URLs entered into their browsers. As a note, all network hosts derive their IPv6 addresses using stateful address autoconfig. What could be the possible issue or issues? And what Wireshark display filter could you use to quickly determine the network problem? Case Project 6-3 Describing Initial IPv6 Host Communications In preparing for an IPv6 implementation at your company, you are responsible for providing basic IPv6 operations information to the desktop support team. One of the topics in your document is to describe the initial IPv6 communications process that a host invokes when its network interface becomes active and what information it retains locally as a result of what it “learns” during those processes. Create a corresponding description to document what is learned and retained in that process.