Have you ever wondered what happens behind the scenes when you open a website?
When we enter a website address in a browser, several network processes take place before the webpage is displayed. These include DNS resolution, TCP connection establishment, TLS negotiation, and encrypted HTTPS communication.
In this practical analysis, I used Wireshark to capture and analyze the network traffic generated while accessing a website. The website name is not mentioned in this article for privacy purposes.
The main purpose of this practical was to understand how different network protocols work together during a real-world web browsing session.
What is Wireshark?
Wireshark is an open-source network protocol analyzer used to capture and inspect network packets.
It allows us to observe network communication in detail, including:
Source and destination IP addresses
Protocols
Port numbers
Packet sizes
TCP connections
DNS requests
TLS communication
Network conversations
Wireshark is widely used for network troubleshooting, security analysis, and learning how network protocols work.
Objective
The objective of this practical was to:
Capture website-related network traffic using Wireshark
Analyze DNS requests and responses
Understand the TCP three-way handshake
Examine TLS traffic
Operating System: Windows
Network Connection: Wi-Fi
Tool Used: Wireshark
Browser: [Chrome / Edge / Firefox]
Target: A website used for practical analysis
Packet Capture
First, I opened Wireshark and selected the Wi-Fi network interface because my Windows system was connected to the internet through Wi-Fi.
I started the packet capture and then opened the target website in a web browser. After allowing the website to load completely, I performed a few normal browsing actions and then stopped the capture.
This gave me a collection of packets that could be analyzed using Wireshark.
1. DNS Analysis
The first part of the analysis was DNS traffic.
I used the following Wireshark display filter:
dns
DNS, or Domain Name System, is responsible for resolving domain names into IP addresses.
By examining the DNS packets, I was able to observe the DNS query and response generated during the website access.
The DNS response provided information about the IP address associated with the requested domain.
2. TCP Three-Way Handshake
Next, I analyzed TCP traffic using:
tcp
TCP uses a three-way handshake to establish a reliable connection between the client and server.
The three stages are:
Client → Server : SYN
Server → Client : SYN-ACK
Client → Server : ACK
The first packet contains the SYN flag.
The server responds with SYN-ACK.
Finally, the client sends an ACK packet.
This process establishes the TCP connection before further communication takes place.
3. TLS Analysis
Since modern websites generally use HTTPS, I also analyzed TLS traffic.
I used the following filter:
tls
I observed TLS handshake packets, including the Client Hello and Server Hello messages.
The Client Hello contains information used during the TLS negotiation, such as supported cryptographic parameters and extensions.
One important observation was that the actual webpage content was not visible as normal readable text in the packet capture because the communication was encrypted.
Key Observations
From this practical analysis, I observed the following:
Analysis Observation
DNS Domain resolution traffic was observed
TCP Three-way handshake was observed
TLS TLS handshake packets were observed
This practical helped me understand that opening a website involves much more network communication than what is visible in a browser.
I learned how:
DNS converts a domain name into an IP address.
TCP establishes a reliable connection using a three-way handshake.
TLS helps establish secure communication.
HTTPS encrypts application data.
Wireshark can be used to inspect packets and understand network activity.
Protocol hierarchy and conversation statistics can provide a broader view of network traffic.
Conclusion
Wireshark provides a useful way to understand what happens behind the scenes when accessing a website.
Through this practical analysis, I was able to observe DNS resolution, TCP connection establishment, TLS negotiation, IP communication, and encrypted HTTPS traffic.
The practical also helped me understand an important cybersecurity concept: network packets can reveal useful information about communication, while encryption helps protect the actual application data from being viewed as plain text.
Overall, this hands-on exercise gave me a better understanding of network protocols and how Wireshark can be used for network analysis and cybersecurity learning.
Disclaimer
This analysis was performed for educational and cybersecurity learning purposes on a website that I was authorized to access. No attempt was made to bypass security mechanisms, access unauthorized information, or interfere with the website's operation.
