Packet Analysis – How to Use Wireshark to Capture CSMA/CD

packet-analysis

I was assigned to capture the packets which are used in CSMA/CD protocol over the local network.

I have googled around for more than a day but haven't found any solution or related work that negotiate how to set up the environment.

I have tried to simulate by using 3 computers connected to the same router by wired (Airport Extreme) I called them station A, B, and C.

I install and used the wireshark on these stations to capture the packets.

I let the station A and B ping to C for about 2 minutes after that I stopped and saved the traces from all stations.

I have analyzed the packet by using the error, retransmission, and broadcast filter.

But, I haven't seen any collisions.

Did I do something wrong ? Is there any other suggestion for setting up the environment to simulate the CSMA/CD ?

Thank you.

PS. Sorry for my english.

Best Answer

Well, your assignment alone leaves room for interpretation.

As Ethernet (at least up to GBit-Ethernet) is defined by it use of CSMA/CD, it might be enough to capture just Ethernet frames.

As YLearn noted you wont see any collisions in a switched network (unless something is terribly broken). Even in an environment using Hubs (good luck finding some) or a shared Media like good old 10Base-T you may not see these packets. These packets are most likely filtered out by your network interface. To capture them you have to used specialized Network interfaces.

What you should see is a counter for collision, e.g. with ifconfig on Linux or show interface on Cisco IOS

Related Solutions

Will WireShark assume packets are DUP or Retransmitted

Wireshark stores the sequence number for a given TCP flow. If the new packet does not advance the sequence number, then it marks it as a retransmission.

This is the actual Wireshark code in epan/dissectors/packet-tcp.c (included inline below).

Please look at the tcp_analyze_sequence_number() function, more specifically the block starting at line 822.

Line 822 of epan/dissectors/packet-tcp.c (Revision 33861):

/* RETRANSMISSION/FAST RETRANSMISSION/OUT-OF-ORDER
 * If the segments contains data and if it does not advance
 * sequence number it must be either of these three.
 * Only test for this if we know what the seq number should be
 * (tcpd->fwd->nextseq)
 *
 * Note that a simple KeepAlive is not a retransmission
 */
if( seglen>0
&&  tcpd->fwd->nextseq
&&  (LT_SEQ(seq, tcpd->fwd->nextseq)) ){
    guint64 t;

    if(tcpd->ta && (tcpd->ta->flags&TCP_A_KEEP_ALIVE) ){
        goto finished_checking_retransmission_type;
    }

    /* If there were >=2 duplicate ACKs in the reverse direction
     * (there might be duplicate acks missing from the trace)
     * and if this sequence number matches those ACKs
     * and if the packet occurs within 20ms of the last
     * duplicate ack
     * then this is a fast retransmission
     */
    t=(pinfo->fd->abs_ts.secs-tcpd->rev->lastacktime.secs)*1000000000;
    t=t+(pinfo->fd->abs_ts.nsecs)-tcpd->rev->lastacktime.nsecs;


    if( tcpd->rev->dupacknum>=2
    &&  tcpd->rev->lastack==seq
    &&  t<20000000 ){
        if(!tcpd->ta){
            tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE, tcpd);
        }
        tcpd->ta->flags|=TCP_A_FAST_RETRANSMISSION;
        goto finished_checking_retransmission_type;
    }

    /* If the segment came <3ms since the segment with the highest
     * seen sequence number, then it is an OUT-OF-ORDER segment.
     *   (3ms is an arbitrary number)
     */
    t=(pinfo->fd->abs_ts.secs-tcpd->fwd->nextseqtime.secs)*1000000000;
    t=t+(pinfo->fd->abs_ts.nsecs)-tcpd->fwd->nextseqtime.nsecs;
    if( t<3000000 ){
        if(!tcpd->ta){
            tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE, tcpd);
        }
        tcpd->ta->flags|=TCP_A_OUT_OF_ORDER;
        goto finished_checking_retransmission_type;
    }

    /* Then it has to be a generic retransmission */
    if(!tcpd->ta){
        tcp_analyze_get_acked_struct(pinfo->fd->num, TRUE, tcpd);
    }
    tcpd->ta->flags|=TCP_A_RETRANSMISSION;
    nstime_delta(&tcpd->ta->rto_ts, &pinfo->fd->abs_ts, &tcpd->fwd->nextseqtime);
    tcpd->ta->rto_frame=tcpd->fwd->nextseqframe;
}

Wireshark – Capture Only TCP Packets with RST Flag

The RST flag is at the bit representing the number 4 within this byte

refers to the numerical value of bit 2 (2² = 4) - the bits are numbered 76543210 from MSB to LSB with the numerical values 128, 64, 32, 16, 8, 4, 2, 1.

In the same manner, URG is bit 5 and 2⁵ = 32.

Best Answer

Related Solutions

Will WireShark assume packets are DUP or Retransmitted

Wireshark – Capture Only TCP Packets with RST Flag

Related Topic