Lab Assignment 14

Lab Assignment Number 14
Lab Assignment Name Capture and Analyze IoT Device Traffic

Screenshots (Paste at least 5 screenshots here):
Lab Observations/Information Gathered:
Wireshark is a free and open-source packet analyzer. It facilitates network troubleshooting,
analysis, software and communications protocol development, and education. It is used to
identify the target OS and sniff/capture the response generated from the target machine to the
machine from which a request originates.
Here, we use Wireshark to capture and analyze traffic between IoT devices.
In the terminal window, type sudo snap install mqtt-explorer and press Enter to install the
MQTT Explorer tool.
MQTT Explorer is a comprehensive MQTT client that provides a structured overview of your
MQTT topics and simplifies working with devices/services on your broker.
In the [sudo] password for ubuntu option, enter toor as the password and press Enter.
After the installation is complete, click on Parrot Security switch to the Parrot Security machine.
By default, attacker user profile is selected, type toor in the Password field and press Enter to
login.
In the Question prompt asking "Do you want to check for updates?", click No.
Go to Application -> Pentesting -> Most Used Tools and click wireshark to launch the
Wireshark application.
Double-click the interface icon in front of SSH remote capture: sshdump option.
Under Server tab of the Wireshark Interface Options window, enter Ubuntu's machine IP
address (10.10.10.9) for Remote SSH server address and 22 for Remote SSH server
port. Switch to Authentication tab
Under Authentication tab of the Wireshark Interface Options window, enter ubuntu for
Remote SSH server username and toor for Remote SSH server password. Switch to
Capture tab.
Under Capture tab of the Wireshark Interface Options window, enter eth0 for Remote
interface and not port 22 for Remote capture filter, and click Start.
Here, eth0 is the interface in the Ubuntu machine from where we have to capture traffic and
not port 22 instructs Wireshark to filter out SSH traffic from the capture.
Switch back to the Ubuntu machine. In the terminal window, type mqtt-explorer and press
Enter to launch the MQTT Explorer tool.
In the MQTT Connection window, enter the Host as mqtt.eclipseprojects.io and click
CONNECT.
It takes some time for the connection to establish.
Now, in the Apply a display filter field, type mqtt and press Enter to display only the MQTT
protocol packets.
The packets might differ in your lab environment.
Select a Connect Command packet from the Packet List pane. In the Packet Details pane
at the middle of the window, expand the Transmission Control Protocol and MQ Telemetry
Transport Protocol nodes.
1. Under the MQ Telemetry Transport Protocol nodes, you can observe details such as
Protocol Name, Version, and Client ID.
Note: The MQTT protocol establishes a connection between clients through a broker. A CONNECT
command is sent to initiate a connection from the client to the broker. After the connection is
established, it remains active until a disconnect command is sent from the client. Some of the
headers of the CONNECT command are given below:
a. Header Flags: Contains information regarding the MQTT control packet type.
b. Connect Flags: Contains parameters specifying the behavior of the MQTT
connection.
c. Clean Session: Indicates whether the client wants to establish a persistent
connection with the broker or not.
d. Client ID: Indicates a unique identifier for each MQTT client connecting to an
MQTT broker.
Select a Connect Ack packet from the Packet List pane. In the Packet Details pane at the
middle of the window, expand the Transmission Control Protocol, MQ
Telemetry Transport Protocol, and Header Flags nodes.
Under the MQ Telemetry Transport Protocol nodes, you can observe details such as Header
Flag and Return Code.
Note: The broker sends the Connect Ack packet on receiving a Connect command request from
the client. Some of the headers in the Connect Ack packet are given below:
e. Header Flags: Contains information regarding the MQTT control packet type.
f. Session Present: Indicates the session between the broker and client; Bit 0 is the
Connection Ack bit in the session present flag.
Select a Subscribe Request packet from the Packet List pane. In the Packet Details pane at
the middle of the window, expand the Transmission Control Protocol, MQ Telemetry
Transport Protocol, and Header Flags nodes.
Under the MQ Telemetry Transport Protocol nodes, you can observe details such as Msg
Len, Message Identifier, and Topic Length.
Note: To receive a relevant message, a client sends a SUBSCRIBE message to an MQTT broker.
Some of the headers in the Subscribe Request packet are given below:
 Header Flags: Contains information regarding the MQTT control packet type.
 Message Identifier: Identifies a message in a message flow between a client and
a broker.
 Topic and QoS Level: A subscription is a pair of a topic filter and a QoS level; the
topic defines a subject of interest on which the client would like to get messages.
 Payload: Contains a list of subscriptions.
Select a Subscribe Ack packet from the Packet List pane. In the Packet Details pane at the
middle of the window, expand the Tran Note: The MQTT broker confirms subscription by
sending an acknowledgment back to the client using a SUBACK message. Some of the headers in
the Subscribe Acknowledgement packet are given below:
g. Header Flags: Contains information regarding the MQTT control packet type.
h. Message Identifier: Identifies a message in a message flow between a client and
a broker.
i. Payload: Contains a list of return codes.
j. Return Code: For each Topic/QoS pair received, a return is sent by the MQTT
broker in the SUBSCRIBE message; the return code is in line with the QoS level in
the case of a success.
smission Control Protocol, MQ
Telemetry Transport Protocol, and Header Flags nodes.
Len and Message Identifier.
Select any Publish Message packet from the Packet List pane. In the Packet Details pane at
Len, Topic Length, Topic, and Message.
Publish Message can be used to obtain the message sent by the MQTT client to the broker.
Note: After establishing a successful connection with the MQTT broker, the MQTT client can
publish messages. The headers in the Publish Message packet are given below:
k. Header Flags: Contains information regarding the MQTT control packet type.
l. DUP flag: If the DUP flag is 0, it indicates the first attempt at sending this
PUBLISH packet; if the flag is 1, it indicates a possible re-attempt at sending the
message.
m. QoS: Determines the assurance level of a message.
n. Retain Flag: If the retain flag is set to 1, the server must store the message and
its QoS, so it can cater to future subscriptions matching the topic.
o. Topic Name: Contains a UTF-8 string that can also include forward slashes when
it needs to be hierarchically structured.
p. Message: Contains the actual data to be transmitted.
q. Payload: Contains the message that is being published.
Select any Publish Release packet from the Packet List pane. In the Packet Details pane at
Len, Message Type, Message Identifier.
Note: A Publish Release (PUBREL) packet is the response to a Publish Received (PUBREC) packet.
Now, scroll down, look for the Publish Complete packet from the Packet List pane, and click
on it. In the Packet Details pane at the middle of the window, expand the Transmission
Control Protocol, MQ Telemetry Transport Protocol, and Header Flags nodes.
Len and Message Identifier.
Note: The Publish Complete (PUBCOMP) packet is the response to a Publish Release (PUBREL)
packet.
This concludes the demonstration of capturing and analyzing MQTT protocol packets. Here, we
analyzed different processes involved in the communication between an MQTT client and an
MQTT broker using Wireshark. Understanding these metrics as well as the workflow can help you
in quickly identifying the MQTT-related issues.
Lab Assignment Submission Template

Lab Assignment 14

Uploaded by

Copyright:

Available Formats

Lab Assignment 14

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Lab Assignment 14

Uploaded by

Copyright:

Available Formats

Lab Assignment Number 14

Lab Assignment Name Capture and Analyze IoT Device Traffic

Lab Assignment Submission Template

You might also like