Okay.
So let's see if we can answer these questions together.
First question is which version of OSPF is used in the topology?
So all I've done is run a filter on this Wireshark capture for OSPF.
So OSPF allows me to filter out the other protocols and only see the OSPF messages.
What we're seeing here is a router with this IP address ten one, two, three, two, five, one and
another router with this IP address ten one, two, three, two.
Sending multi costs to the well-known multicast address of 224005.
So we see some hello packets and then we actually see a message directly from one router to the other.
We see continued hello packets and then we get some database description messages, request messages,
so link state to request and update messages, database descriptions and so forth.
But just off these hello messages, we should be able to determine a lot of information.
I'm going to go into a little bit more detail here.
I hope that's okay.
But I want to make sure that everyone understands how the protocol works.
First thing.
Layer two Notice Source Mac Address.
Destination is the OSPF multicast address.
So IP version for multicast.
This is the MAC address for IP version for multicast.
01005e and then this portion, the lost 23 bits actually is determined by multicast addresses.
The well-known multicast address, as we can see here for OSPF is 224005.
So the MAC address is 000005.
So multicast MAC address for OSPF at layer two, we see that the layer three protocol is IP version
four.
So the type field is set to zero 800.
So IP version four, source IP address, destination IP address.
We can see once again, he has an interesting field.
Notice the DHCP or differentiated services code points is set to see a six clause selector six.
That is actually a higher priority than expedited forwarding, which is used for voice of IP.
Routing protocols are deemed to be more important than voice of IP.
In other words, this is some of the most important traffic that you can have have on a network, and
it makes sense if you can't route.
In other words, if routing protocols can't communicate and can't send writing updates to each other,
you will not be able to afford traffic in your network.
So everything else will break.
So you need your routing protocols to be prioritized over other traffic types.
So see us six in other words, very, very important traffic in the network.
But let's go down a bit further.
I'll.
Make the shock window bigger.
Notice protocol ospf IGP Protocol number 89.
This is the well known protocol number for OSPF.
It's a good one to remember.
So 89 is OSPF, which actually makes it easy for us.
It's interpreting the protocol number automatically.
Source IP address.
Destination IP address once again displayed.
This implies that this is OSPF.
So in Wireshark at layer four, we see OSPF.
So layer two Ethernet, layer three IP, version four, layer four OSPF.
There's a bit of debate whether OSPF is layer three or layer four.
We won't get into that debate.
But essentially OSPF relies on IP version four in this case.
So which version of OSPF are we running?
It's OSPF version two.
So which version of OSPF v2?
We can see that clearly in the Wireshark capture over there.
This is a hello packet.
This is the size of the packet.
So it's length.
This is the source of the message.
This is actually the IP address of router one.
This IP address ten 13252 is the IP address of router two.
But for now.
Note IP address.
Of right one area ID 0000 backbone area.
So we can actually answer this question as well, the backbone area and I'll make this a different color,
let's say blue.
Area is.
The area in this example is area zero.
It can be written as zero or it can be written like this same thing.
Is it a router?
Is it a tomato?
Same concept.
It's area zero.
Okay.
So check some is correct.
That means there's no problem with a packet.
Notice your authentication type is simple password.
So is authentication used?
Yes, it is.
So authentication is simple.
Simple password is used.
Very bad idea.
But that's what we've got here.
Notice she has the password.
It's OSPF pos.
So that is the password.
Not a good idea to use clear text protocols in a network.
It's very, very simple to capture the passwords.
There you go.
There's the password shown clearly in the Wireshark capture.
So be careful using clear text passwords with OSPF.
We actually want to use MD5, not clear text.
Better to use MD5 passwords.
Okay.
Another question, what are the OSPF router priorities?
So let's dig down a little bit deeper.
We can see the Hello packet notice network mask.
Notice.
Yeah.
Priority.
So this is right on one.
If you didn't know the answer to that, you could just say the one writer has a priority of 101.
And if we jump to a 2/2 writer, notice it's Priorities 102.
So write a 202.
Very easy to read.
Why Shock captures if you understand the data or understand what you're looking at.
Once again, you get free access to my Q&A course if you want to learn more about this.
Have a look at my CCNA course.
But in brief.
OSPF is a routing protocol run within an autonomous system.
Router priorities for determining who's in charge of a segment is done based on rate of priority.
One of the determining factors.
Highest priority wins.
Notice at this point we don't see designated Rada and back up designated Rada.
There is an election that takes place.
That election hasn't completed.
So let's go right to the end.
In other words, later.
Hello packets.
Once the Rada started talking to each other.
So notice here we've got no back up designated Rada.
But if we go through the messages, you'll see they will negotiate a bunch of stuff.
And then we should start seeing in the hollow messages like here.
Who the designated Rada is and who the backup designated Rada is.
So who's.
Designated rider.
The designated rider in this topology.
Is 10.1232252.
As we can see over there.
Highest party wins.
This writer has a high priority 102.
So it's going to be the designated writer.
Okay.
So I've answered all those questions.
How did you get on?
Were you able to answer these questions?
The thing about Wireshark is you can dig really deep, but you need to understand the protocols.
So you need to spend some time learning the theory of protocols.
I mean, this means nothing if you don't understand what you're looking at.
So you need to spend some time learning about OSPF.
Once again OSPF version to later releases of OSPF OSPF version three would be used in an IP version
six environment.
In this example, we just looking at OSPF for IP version four.
If you don't understand what a backbone router is, it doesn't make any sense.
It's important that you learn your writing protocols.
So let's actually have a look at the consoles of the routers.
This router one.
He has wrought a to just to prove that what I've explained through my shock is actually true.
So show IP and let's do the easy one to show IP interface brief rather.
You can see this is the Router's IP address on gigabit zero one.
This interface here on router to show IP interface brief.
This is the IP address on gigabit zero zero.
This interface.
Show IP ospf neighbor notice this router rather one has a neighbor relationship with router two.
We can see that it's a full relationship.
The other router, in other words, rather two is the designated router per what we worked out in Wireshark.
So show IP interface brief on this side.
Make that bigger.
Notice that's the wrong command.
Sorry to show IP OSPF neighbor rather so rather two sees right one as a backup designated router full
relationship on a Ethernet segment, the designated rod and backup designated router form full relationships
with other routers.
In other words, they exchange the topology database with other routers and we can see that over here.
Notice we've got hollows and then we've got a database description.
So in the output here we can see a description of the database.
So some information about the database is shown in the capture.
So you see some information about the database.
But the one I want to point out is notice as we go down, we've got a link state request message and
then we've got a link state update message.
Notice Alyssa type one.
So if you've learned a bit about OSPF, you'll know about LSA type one, two, three, four and five
as an example.
Notice we can see in network information this is a stub network ten 120.
He has another stub network ten 130.
This was advertised by ten 123252, which is actually rather 210 1230 is the segment between the routers.
Notice you can see ten one three something being advertised here.
This network is ten 120 and we can see that once again over here, ten 120 is the subnet on this interface.
Gigabit zero one if you actually want to see that, we can do it this way as well.
So run interface gigabyte zero one notice this is.
The configuration of that interface.
And if I type show run or show IP interface gigabit zero one, you can see the IP address and the subnet
mask on that interface.
Okay.
So we can see here the networks that are going to be advertised by the two riders to each other.
Here we see a database description.
He has another update.
So basically the routers are communicating information to one another.
This is right.
A one note is two five.
One different network is shown here, ten 110.
So we see ten 130.
That's the network between the two routers and ten 110.
Advertise between.
Or should I say from router one to right or two, we can see the metric or the cost to get there.
So network subnet metric of this network, it's a.
It's a stub network.
In other words, there's no other router connected to this network.
A lot of information can be gleaned from Wireshark.
You see acknowledgements.
OSPF doesn't rely on TCP.
So if you have a look here, there's no TCP protocol.
If it sends a link state update to the other router, it needs an acknowledgement back to make sure
that the other router got to the update.
Otherwise it's going to retransmit that data because there's no TCP to do the transmissions and make
sure that data gets through.
OSPF has its own mechanism to do that.
And you can see that once again through the Wireshark captures link state update link state acknowledgement.
So the one router requests data, the other person updates, and then we give back an acknowledgement
to make sure that it got through properly.
Well, acknowledge to the other person that we received what they were sending us.
Again.
Why?
Shock is brilliant.
You can see so much information just by looking at a CAPTCHA.
There are other protocols running on this network we can see broadcast share so up we can see spanning
three other protocols.
But by simply searching for OSPF, we can see the OSPF messages and then interpret what's going on.
Again.
How did you get on if you weren't able to answer the questions?
Don't worry.
Just to learn.
Learn.
Wireshark.
It will help you tremendously in the real world.
It's an important skill for any networker to have or anyone interested in sort of ethical hacking.
You want to be able to learn what's going on in the network, and by simply running a sniffer like Wireshark,
you can actually see a whole bunch of stuff on the network.