Packet Sniffing

This week we were tasked with practicing packet sniffing. 

I used the free, open-source software WireShark . For this exercise, I ran in on my computer while logged into the NYU network, and I wasn’t using my laptop at the time, so I only sniffed 459 packets. 

packet sniffing chart

packet sniffing chart

I thought it would be interesting to take all the HTTP data and run the IP addresses through NS Lookup on my terminal. I wanted to see the companies that my information was traveling through. To do this, I filtered by HTTP and downloaded the data to a CSV file, and I then uploaded it to google sheets and isolated the IP address. 

google sheet

I noticed that most of my information was going through either amazon web services or google. 

Next, I ran a tutorial on WireShark that allowed me to test a nonsecure HTTP website. You can see below that I was able to find both the user name and password. It’s fascinating how easily I was able to get that information and just how vital HTTPS is. 

Tracerouting

I had so much fun with this assignment! Before this week, I was completely unaware of my web searchers’ journey before popping up on my screen! It really took me back thinking about how much work has gone into me getting cat memes quickly. 

For this write-up, I focused on tracing my website and google from my home network and studio. It was interesting to see how different the paths were, even though the two physical locations are only 1.5 miles away. Two things took me by surprise; first, when I traced Google from my studio, it went all the way to Austria. I do not understand that. Second, most of me searched from my home location went through Ashburn, Virginia after doing a little research I found out that Northern, Virginia contains  “more than 100 data centers and more than 10 million square feet of data center space.” according to an article titled Equinix Expands in Ashburn, Plans Fleet of Four-Story Data Centers by Rich Miller. The entire article can be seen here.

Home Network: 

My Website: 

traceroute to 69.22.188.41 (69.22.188.41), 64 hops max, 52 byte packets

 1  192.168.4.1 (192.168.4.1)  17.701 ms  4.762 ms  4.803 ms

 2  * * *

 3  100.41.23.156 (100.41.23.156)  11.109 ms  10.788 ms

    100.41.23.154 (100.41.23.154)  10.732 ms

 4  0.csi1.grcynygc-mse01-bb-su1.alter.net (140.222.3.206)  11.245 ms

    0.csi1.whplnywp-mse01-bb-su1.alter.net (140.222.3.212)  11.641 ms

    0.csi1.grcynygc-mse01-bb-su1.alter.net (140.222.3.206)  10.593 ms

 5  * * *

 6  0.ae3.br2.nyc4.alter.net (140.222.1.59)  13.313 ms

    0.ae4.br2.nyc4.alter.net (140.222.1.61)  11.917 ms

    0.ae3.br2.nyc4.alter.net (140.222.1.59)  14.212 ms

 7  verizon-com.customer.alter.net (152.179.78.154)  12.663 ms  21.930 ms  13.422 ms

 8  ae-2-3605.ear1.newyork1.level3.net (4.69.202.253)  10.972 ms

    ae-1-3505.ear1.newyork1.level3.net (4.69.141.133)  13.904 ms

    ae-2-3605.ear1.newyork1.level3.net (4.69.202.253)  20.201 ms

 9  photoshelte.ear1.newyork1.level3.net (4.14.2.138)  13.710 ms  12.626 ms  10.113 ms

10  xe-0-2-3.cr2.nyc.bitshelter.com (63.141.214.43)  14.760 ms  12.401 ms  9.473 ms

11  le2.nyc.bitshelter.com (69.22.188.41)  12.732 ms  11.736 ms  12.085 ms

wildgeese@Alans-MacBook-Pro-2 ~ % nslookup www.google.com     

Server: 68.237.161.12

Address: 68.237.161.12#53

Trace routing map

Google

 1  192.168.4.1 (192.168.4.1)  5.836 ms  4.623 ms  4.936 ms

 2  * * *

 3  100.41.23.154 (100.41.23.154)  11.176 ms  10.707 ms  10.386 ms

 4  0.csi1.whplnywp-mse01-bb-su1.alter.net (140.222.3.212)  13.685 ms

    0.csi1.grcynygc-mse01-bb-su1.alter.net (140.222.3.206)  16.654 ms

    0.csi1.whplnywp-mse01-bb-su1.alter.net (140.222.3.212)  16.569 ms

 5  * * *

 6  * * *

 7  0.et-9-0-5.gw15.nyc1.alter.net (140.222.1.81)  13.455 ms

    0.et-9-0-2.gw15.nyc1.alter.net (140.222.1.43)  13.813 ms  10.820 ms

 8  &#10.20.148.204.in-addr.arpa (204.148.20.6)  10.003 ms

    72.14.208.130 (72.14.208.130)  11.312 ms  9.088 ms

 9  108.170.248.97 (108.170.248.97)  9.775 ms  9.966 ms

    10.252.243.222 (10.252.243.222)  12.378 ms

10  142.250.46.197 (142.250.46.197)  12.561 ms  11.884 ms

    108.170.248.1 (108.170.248.1)  11.917 ms

11  108.170.248.20 (108.170.248.20)  11.732 ms

  lga34s30-in-f4.1e100.net (142.250.64.68)  11.290 ms  16.258 ms

Trace routing map

My Studio:

My Website

traceroute to 69.22.188.41 (69.22.188.41), 64 hops max, 52 byte packets

 1  router.asus.com (192.168.50.1)  9.812 ms  1.288 ms  1.288 ms

 2  * * *

 3  g0-15-4-5.bstnma-lcr-22.verizon-gni.net (100.41.6.88)  11.718 ms  11.595 ms  6.344 ms

 4  0.csi1.whplnywp-mse01-bb-su1.alter.net (140.222.3.212)  8.332 ms  8.549 ms

    0.csi1.grcynygc-mse01-bb-su1.alter.net (140.222.3.206)  5.944 ms

 5  * * *

 6  0.ae4.br2.nyc4.alter.net (140.222.1.61)  8.136 ms

    0.ae3.br2.nyc4.alter.net (140.222.1.59)  7.179 ms

    0.ae4.br2.nyc4.alter.net (140.222.1.61)  6.820 ms

 7  verizon-com.customer.alter.net (152.179.78.154)  7.322 ms  11.071 ms  9.831 ms

 8  * * *

 9  photoshelte.ear1.newyork1.level3.net (4.14.2.138)  13.789 ms  6.305 ms  7.508 ms

10  xe-0-2-3.cr2.nyc.bitshelter.com (63.141.214.43)  10.402 ms  13.270 ms  5.905 ms

11  le2.nyc.bitshelter.com (69.22.188.41)  8.399 ms  9.520 ms  6.887 ms

Trace routing map

Google

traceroute to 142.250.65.196 (142.250.65.196), 64 hops max, 52 byte packets

 1  router.asus.com (192.168.50.1)  23.906 ms  12.252 ms  3.303 ms

 2  * * *

 3  g104-0-0-30.phlapa-lcr-21.verizon-gni.net (100.41.6.240)  17.315 ms  5.793 ms  7.229 ms

 4  0.csi1.whplnywp-mse01-bb-su1.alter.net (140.222.3.212)  8.899 ms

    0.csi1.grcynygc-mse01-bb-su1.alter.net (140.222.3.206)  8.036 ms

    0.csi1.whplnywp-mse01-bb-su1.alter.net (140.222.3.212)  17.325 ms

 5  * * *

 6  * * *

 7  0.et-9-1-5.gw15.nyc1.alter.net (140.222.230.215)  14.260 ms

    0.et-10-0-2.gw15.nyc1.alter.net (140.222.1.45)  6.558 ms

    0.et-9-1-2.gw15.nyc1.alter.net (140.222.227.25)  10.936 ms

 8  72.14.208.130 (72.14.208.130)  8.799 ms

    &#10.20.148.204.in-addr.arpa (204.148.20.6)  7.916 ms  6.110 ms

 9  108.170.248.65 (108.170.248.65)  6.724 ms  11.725 ms

    10.252.164.30 (10.252.164.30)  7.819 ms

10  142.251.60.232 (142.251.60.232)  9.612 ms

    142.251.60.239 (142.251.60.239)  8.807 ms

    142.251.60.237 (142.251.60.237)  8.747 ms

11  142.251.60.237 (142.251.60.237)  7.265 ms

    lga25s72-in-f4.1e100.net (142.250.65.196)  9.040 ms  7.949 ms

Trace routing map

NYTimes 

traceroute to 151.101.209.164 (151.101.209.164), 64 hops max, 52 byte packets

 1  router.asus.com (192.168.50.1)  7.700 ms  1.245 ms  1.249 ms

 2  * * *

 3  g0-15-4-5.bstnma-lcr-22.verizon-gni.net (100.41.6.88)  11.749 ms  9.508 ms

    g104-0-0-30.phlapa-lcr-21.verizon-gni.net (100.41.6.240)  13.217 ms

 4  0.csi1.grcynygc-mse01-bb-su1.alter.net (140.222.3.206)  29.958 ms  6.361 ms  7.163 ms

 5  * * *

 6  0.ae2.gw13.ewr6.alter.net (140.222.8.13)  10.855 ms

    0.ae1.gw13.ewr6.alter.net (140.222.8.11)  6.183 ms

    0.ae2.gw13.ewr6.alter.net (140.222.8.13)  17.332 ms

 7  * * *

 8  * * *

 9  * * *

10  * * *

11  * * *

12  * * *

13  * * *

14  * * *

15  * * *

16  * * *

17  * * *

18  * * *

19  * * *

20  * * *

21  * * *

22  * * *

23  * * *

24  * * *

25  * * *

26  * * *

27  * * *

28  * * *

29  * * *

30  * * *

31  * * *

32  * * *

33  * * *

34  * * *

35  * * *

36  * * *

37  * * *

38  * * *

39  * * *

40  * * *

41  * * *

42  * * *

43  * * *

44  * * *

45  * * *

46  * * *

47  * * *

48  * * *

49  * * *

50  * * *

51  * * *

52  * * *

53  * * *

54  * * *

55  * * *

56  * * *

57  * * *

58  * * *

59  * * *

60  * * *

61  * * *

62  *  **

64  * * *

Trace routing map