Scribd
Upload
168 views24 pages

"Print As Displayed" and Then Click OK

The document summarizes the results of a laboratory experiment analyzing network traffic captures from a local area network. It lists the different protocols observed including HTTP, TCP, UDP, DNS, and others. It describes the time it took to receive an HTTP response and identifies the IP addresses of the client computer and the web server. It also prints the HTTP request and response messages and provides additional details about the network traffic.

Uploaded by

Angel A. Moran G.
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
168 views24 pages

"Print As Displayed" and Then Click OK

The document summarizes the results of a laboratory experiment analyzing network traffic captures from a local area network. It lists the different protocols observed including HTTP, TCP, UDP, DNS, and others. It describes the time it took to receive an HTTP response and identifies the IP addresses of the client computer and the web server. It also prints the HTTP request and response messages and provides additional details about the network traffic.

Uploaded by

Angel A. Moran G.
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 24

Redes de rea Local

Laboratorio N.1 (Parte 1)

INTRO 1. List the different protocols that appear in the protocol column in the unfiltered packet-listing window in step 7 above. HTTP, TCP, UDP, DNS, VTP, STP, IGMP, ARP, DTP, CDP, NBNS. 2. How long did it take from when the HTTP GET message was sent until the HTTP OK reply was received? (By default, the value of the Time column in the packetlisting window is the amount of time, in seconds, since Wireshark tracing began. To display the Time field in time-of-day format, select the Wireshark View pull down menu, then select Time Display Format, then select Time-of-day.)

Presentando en formato fecha del da:

Frame 3: 200 bytes on wire (1600 bits), 200 bytes captured (1600 bits) Arrival Time: Feb 4, 2012 18:18:43.825737000 Hora est. Pacfico, Sudamrica (GET) Arrival Time: Feb 4, 2012 18:18:43.912770000 Hora est. Pacfico, Sudamrica (OK) El tiempo de respuesta al recibir el OK, luego de haber obtenido el GET, es de 0.87033000 segundos. 3. What is the Internet address of the gaia.cs.umass.edu (also known as wwwnet. cs.umass.edu)? What is the Internet address of your computer? 20 19:36:32.201381 172.30.150.116 128.119.245.12 GET /wireshark-labs/INTRO-wireshark-file1.html HTTP/1.1 HTTP 761

The internet address of gaia.cs.umass.edu is 128.119.245.12 The internet address of my computer is 172.30.150.116

4. Print the two HTTP messages displayed in step 9 above. To do so, select Print from the Wireshark File command menu, and select Selected Packet Only and Print as displayed and then click OK.

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

HTTP/1.1 GET Accept: text/html, application/xhtml+xml, */* Accept-Language: es-ES User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Accept-Encoding: gzip, deflate Host: gaia.cs.umass.edu Connection: Keep-Alive

HTTP/1.1 200 OK Date: Sat, 04 Feb 2012 23:52:09 GMT Server: Apache/2.2.3 (CentOS) Last-Modified: Sat, 04 Feb 2012 23:52:01 GMT ETag: "8734b-51-1d91aa40" Accept-Ranges: bytes Content-Length: 81 Keep-Alive: timeout=10, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

<html> Congratulations! You've downloaded the first Wireshark lab file! </html>

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local HTTP

Laboratorio N.1 (Parte 1)

1. Is your browser running HTTP version 1.0 or 1.1? What version of HTTP is the server running? Ambos ejecutan la misma version HTTP 1.1 2. What languages (if any) does your browser indicate that it can accept to the server? Acepta el lenguaje: Accept-Language: es-pa\r\n 3. What is the IP address of your computer? Of the gaia.cs.umass.edu server? Internet Protocol Version 4, Src: 172.30.150.116 (172.30.150.116), Dst: 128.119.245.12 (128.119.245.12) PC=172.30.150.116 gaia.cs.umass.edu server=128.119.245.12

4. What is the status code returned from the server to your browser? El cdigo que devolvi el servidor es: Status Code: 200

5. When was the HTML file that you are retrieving last modified at the server? La ltima vez que fue modificado el archive en el servidor fue: Last-Modified: Thu, 26 Jan 2012 01:11:02 GMT\r\n

6. How many bytes of content are being returned to your browser? La cantidad de bytes que fueron retornados por el navegador. Content length: 128 7. By inspecting the raw data in the packet content window, do you see any headers within the data that are not displayed in the packet-listing window? If so, name one. No, todos los encabezados estn completos y tienen datos. The data is complete. 8. Inspect the contents of the first HTTP GET request from your browser to the server. Do you see an IF-MODIFIED-SINCE line in the HTTP GET?

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

No encuentro ninguna lnea con esa expresin. 9. Inspect the contents of the server response. Did the server explicitly return the contents of the file? How can you tell?

S, porque podemos ver el texto en la lista desplegable Line-based text data: text/html, El servidor enva un mensaje de respuesta OK.

10. Now inspect the contents of the second HTTP GET request from your browser to the server. Do you see an IF-MODIFIED-SINCE: line in the HTTP GET? If so, what information follows the IF-MODIFIED-SINCE: header?

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

Si, este encabezado aparece y tiene la informacin de la ultima vez que fue modificado el archivo If-Modified-Since: Sun, 05 Feb 2012 00:18:02 GMT\r\n 11. What is the HTTP status code and phrase returned from the server in response to this second HTTP GET? Did the server explicitly return the contents of the file? Explain

El cdigo de estado que retorna el servidor es Status Code: 304 La frase de respuesta es que no ha sido modificado, ya que tienen la informacin almacenada en la cache del archivo inicial. En caso de actualizacin en el servidor habra enviado respuesta de su ltima modificacin.

12. How many HTTP GET request messages were sent by your browser?

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

Solo obtuve un mensaje GET de respuesta de mi navegador. 13. How many data-containing TCP segments were needed to carry the single HTTP response?

Los segmentos necesarios para que fuera enviada la respuesta del navegador fueron de 1460, 1460, 1460 y 423 bytes para un total de 4803 bytes. 14. What is the status code and phrase associated with the response to the HTTP GET request? Status Code: 200

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

15. Are there any HTTP status lines in the transmitted data associated with a TCP induced Continuation? No hay ninguna lnea de estado en la data transmitida asociada con un encabezado llamado Continuation en TCP. 16. How many HTTP GET request messages were sent by your browser? To which Internet addresses were these GET requests sent?

Se recibieron tres GET del navegador a las siguientes direcciones: Destination: 128.119.245.12 (128.119.245.12) Destination: 165.193.140.14 (165.193.140.14) Destination: 128.119.240.90 (128.119.240.90)

17. Can you tell whether your browser downloaded the two images serially, or whether they were downloaded from the two web sites in parallel? Explain. Al comprobar los puertos TCP se puede ver si los archivos fueron descargados en serie o en paralelo. En este caso las dos imgenes fueron descargadas desde ms de dos conexiones TCP esto quiere decir que se descargaron en serie, es decir sitios diferentes.

18. What is the servers response (status code and phrase) in response to the initial HTTP GET message from your browser?

El cdigo de estado es 401 y la frase de respuesta es Authorization Required 19. When your browsers sends the HTTP GET message for the second time, what new field is included in the HTTP GET message?

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

El Nuevo campo que aparece en el Segundo HTTP GET es Authorization

DNS

1. Run nslookup to obtain the IP address of a Web server in Asia.

2. Run nslookup to determine the authoritative DNS servers for a university in Europe.

3. Run nslookup so that one of the DNS servers obtained in Question 2 is queried for the mail servers for Yahoo! mail.

4. Locate the DNS query and response messages. Are then sent over UDP or TCP?

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

Son enviados bajo UDP. Protocol: UDP (17) Protocol: UDP (17) 5. What is the destination port for the DNS query message? What is the source port of DNS response message? Puerto del mensaje de consulta: Destination port: domain (53) Puerto del mensaje de respuesta: Source port: domain (53)

6. To what IP address is the DNS query message sent? Use ipconfig to determine the IP address of your local DNS server. Are these two IP addresses the same?

El mensaje de consulta es enviado a la misma direccin del servidor DNS local.

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

7. Examine the DNS query message. What Type of DNS query is it? Does the query message contain any answers? El tipo de consulta DNS es: Type: A (Host address) No hay ningn mensaje o encabezado que diga answer (respuesta). 8. Examine the DNS response message. How many answers are provided? What do each of these answers contain? Hay una respuesta que contiene informacin sobre el nombre del host, el tipo de direccin, la clase, el tiempo de vida, la longitud de los datos y la direccin IP.

9. Consider the subsequent TCP SYN packet sent by your host. Does the destination IP address of the SYN packet correspond to any of the IP addresses provided in the DNS response message? El primer paquete SYN fue enviado a 12.22.58.30 que corresponde a la primera direccin IP proporcionada en el mensaje de respuesta de DNS.

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

10. This web page contains images. Before retrieving each image, does your host issue new DNS queries? No, no contiene imagenes. 11. What is the destination port for the DNS query message? What is the source port of DNS response message? El Puerto de destino del mensaje de consulta Destination port: domain (53) El Puerto de recurso del mensaje de respuesta DNS Source port: domain (53) 12. To what IP address is the DNS query message sent? Is this the IP address of your default local DNS server? La consulta ha sido enviada a la direccin IP 192.168.0.1, que como podemos ver en la captura de pantalla es el servidor DNS local por defecto.

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

13. Examine the DNS query message. What Type of DNS query is it? Does the query message contain any answers?

El mensaje de consulta DNS es de Tipo A y no contiene ninguna respuesta. 14. Examine the DNS response message. How many answers are provided? What do each of these answers contain? El mensaje de respuesta DNS contiene una sola respuesta que contiene el nombre del host, el tipo de direccin, la clase, el tiempo de vida, el tamao de los datos y la direccin IP.

15. Provide a screenshot.

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

16. To what IP address is the DNS query message sent? Is this the IP address of your default local DNS server? La direccin IP a donde se enva la consulta es 192.168.0.1 la cual es la direccin de mi servidor DNS.

17. Examine the DNS query message. What Type of DNS query is it? Does the query message contain any answers? El tipo de consulta DNS es: NS (Nombre del servidor). No contiene ninguna respuesta.

18. Examine the DNS response message. What MIT nameservers does the response message provide? Does this response message also provide the IP addresses of the MIT nameservers? Los servidores de nombres son STRAWB.mit.edu, BITSY.mi.edu y W20NS.mit.edu, En registros adicionales, se pueden encontrar las direcciones IP de los servidores.

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

19. Provide a screenshot.

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

20. To what IP address is the DNS query message sent? Is this the IP address of your default local DNS server? If not, what does the IP address correspond to? La direccin IP a la cual es enviado el mensaje de consulta es 18.72.0.3, esta no es la direccin del Servidor DNS local por defecto. Esta direccin IP corresponde a bitsy.mit.edu

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

21. Examine the DNS query message. What Type of DNS query is it? Does the query message contain any answers? La consulta es tipo A, y no contienen ningn mensaje de respuesta.

22. Examine the DNS response message. How many answers are provided? What does each of these answers contain? El mensaje de respuesta DNS, solo provee una respuesta que contienen el nombre del host, el tipo, la clase, el tiempo de vida, el tamao de los datos y la direccin IP. El contenido lo podemos ver en el recorte abajo.

23. Provide a screenshot.

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local TCP

Laboratorio N.1 (Parte 1)

1. What is the IP address and TCP port number used by the client computer (source) that is transferring the file to gaia.cs.umass.edu? La direccin IP utilizada por el cliente es 192.168.0.101 y el nmero de Puerto 51647 para transferir el archive a gaia.cs.umass.edu

2. What is the IP address of gaia.cs.umass.edu? On what port number is it sending and receiving TCP segments for this connection? La direccin IP de gaia.cs.usmass.edu es 128.119.245.12 y el nmero de puerto donde enva y recibe los segmentos TCP para esta conexin es 80.

3. What is the IP address and TCP port number used by your client computer (source) to transfer the file to gaia.cs.umass.edu? Esta respuesta es la misma que la pregunta nmero, ya que se hizo la captura desde mi computador, la direccin IP del cliente en el archivo ZIP que contena la informacin de la captura de paquetes: tcpethereal-trace-1 en http://gaia.cs.umass.edu/wireshark-labs/wireshark-traces.zip es 192.168.1.102

4. What is the sequence number of the TCP SYN segment that is used to initiate the

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

TCP connection between the client computer and gaia.cs.umass.edu? What is it in the segment that identifies the segment as a SYN segment?

El nmero de secuencia del segmento TCP SYN se utiliza para iniciar la conexin con el protocolo TCP entre el equipo cliente y gaia.cs.umass.edu, es 0 en esta captura de paquetes. El indicador SYN est fijado en 1 y se indica que este segmento es un segmento SYN.

5. What is the sequence number of the SYNACK segment sent by gaia.cs.umass.edu to the client computer in reply to the SYN? What is the value of the ACKnowledgement field in the SYNACK segment? How did gaia.cs.umass.edu determine that value? What is it in the segment that identifies the segment as a SYNACK segment?

El nmero de secuencia del segmento de SYNACK gaia.cs.umass.edu en respuesta al equipo cliente de la peticin SYN tiene el valor de 0 en esta captura de paquetes. El valor del campo ACKnowledgement en el segmento SYNACK es 1. El valor

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

del campo ACKnowledgement en el segmento de SYNACK es determinado por gaia.cs.umass.edu sumndole 1 al nmero de secuencia inicial del segmento SYN desde el equipo cliente (el nmero de secuencia del segmento SYN iniciado por el equipo cliente es 0, sumndole 1 nos da la el valor del campo). La bandera SYN y la bandera ACKnowledgement en el segmento se establece en 1 lo que indica que son segmentos SYNACK. 6. What is the sequence number of the TCP segment containing the HTTP POST command? Note that in order to find the POST command, youll need to dig into the packet content field at the bottom of the Wireshark window, looking for a segment with a POST within its DATA field.

El nmero de secuencia que contienen el commando HTTP POST tiene valor=1.

7. Consider the TCP segment containing the HTTP POST as the first segment in the TCP connection. What are the sequence numbers of the first six segments in the TCP connection (including the segment containing the HTTP POST)? Considerando el segmento HTTP POST como el primer segmento. Los segmentos 1 al 6 son: 8, 9, 11, 13, 14 y 16. Los ACK de los segmentos de 1 a 6 son: 10, 12, 15, 18, 19 y 20.

At what time was each segment sent?

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local Segment 1 sequence number: 1 Segment 2 sequence number: 646 Segment 3 sequence number: 2106 Segment 4 sequence number: 3566 Segment 5 sequence number: 5026 Segment 6 sequence number: 6486 Time: Time: Time: Time: Time: Time:

Laboratorio N.1 (Parte 1)

When was the ACK for each segment received? Given the difference between when each TCP segment was sent, and when its acknowledgement was received, what is the RTT value for each of the six segments?

Los tiempos de envo y recepcin de los segmentos ACKnowledgement son los siguientes: Tiempo de Envo ACK tiempo de recibido RTT (segundos) Segmento 1 0.026477 0.053937 0.02746 Segmento 2 0.041737 0.077294 0.035557 Segmento 3 0.054026 0.124085 0.070059 Segmento 4 0.054690 0.169118 0.11443 Segmento 5 0.077405 0.217299 0.13989 Segmento 6 0.078157 0.267802 0.18964 What is the EstimatedRTT value (see page 249 in text) after the receipt of each ACK? Assume that the value of the EstimatedRTT is equal to the measured RTT for the first segment, and then is computed using the EstimatedRTT equation on page 249 for all subsequent segments. EstimatedRTT = 0.875 * EstimatedRTT + 0.125 * SampleRTT (Tiempo calculado en segundos) EstimatedRTT despus de recibir ACK del segmento 1: EstimatedRTT = RTT for Segment 1 = 0.02746 EstimatedRTT despus de recibir ACK del segmento 2: EstimatedRTT = 0.875 * 0.02746 + 0.125 * 0.035557 = 0.0285 EstimatedRTT despus de recibir ACK del segmento 3: EstimatedRTT = 0.875 * 0.0285 + 0.125 * 0.070059 = 0.0337 EstimatedRTT despus de recibir ACK del segmento 4: EstimatedRTT = 0.875 * 0.0337+ 0.125 * 0.11443 = 0.0438 EstimatedRTT despus de recibir ACK del segmento 5: EstimatedRTT = 0.875 * 0.0438 + 0.125 * 0.13989 = 0.0558 EstimatedRTT despus de recibir ACK del segmento 6: EstimatedRTT = 0.875 * 0.0558 + 0.125 * 0.18964 = 0.0725 Note: Wireshark has a nice feature that allows you to plot the RTT for each of the TCP segments sent. Select a TCP segment in the listing of captured packets window that is being sent from the client to the gaia.cs.umass.edu server. Then select: Statistics->TCP Stream Graph>Round Trip Time Graph.

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

8. What is the length of each of the first six TCP segments? El tamao de cada uno de los primeros segmentos TCP son los siguientes: Segmento 1: 645 bytes. Segmento 2: 1460 bytes. Segmento 3: 1460 bytes. Segmento 4: 1460 bytes. Segmento 5: 1460 bytes. Segmento 6: 1460 bytes.

9. What is the minimum amount of available buffer space advertised at the received for the entire trace? Does the lack of receiver buffer space ever throttle the sender? La cantidad mnima de espacio en el bfer (ventana del receptor) anunciada en gaia.cs.umass.edu para la recepcin es 1460 bytes por segmento. La falta de espacio del receptor impedira la recepcin completa de los paquetes.

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

10. Are there any retransmitted segments in the trace file? What did you check for (in the trace) in order to answer this question? No hay segmentos retransmitidos en el archivo de capturas. Podemos comprobar esto revisando los nmeros de secuencia de los segmentos TCP. En el grfico de secuencia de envi desde 192.168.1.102 hacia 128.119.245.12 aumentan con relacin al tiempo. Si hay un segmento retransmitido, el nmero de secuencia debera ser menor que la de sus segmentos adyacentes.

Prof. Giovana Garrido

ngel A. Morn G.

Redes de rea Local

Laboratorio N.1 (Parte 1)

11. How much data does the receiver typically acknowledge in an ACK? Can you identify cases where the receiver is ACKing every other received segment (see Table 3.2 on page 257 in the text).

ACK 1 ACK 2 ACK 3 ACK 4 ACK 5

Nmero de Secuencia ACKnowledged 646 2106 3566 5026 6486

Nmero de Secuencia ACKnowledged Datos 645 1460 1460 1460 1460

La diferencia entre dos ACK consecutivos indica la cantidad de datos recibidos por el servidor. No se observaron casos donde se reciba otro tipo de segmentos. 12. What is the throughput (bytes transferred per unit time) for the TCP connection? Explain how you calculated this value. El clculo de rendimiento TCP depende del periodo de tiempo de transmisin promedio. Esto lo realizamos como calcularamos cualquier otro promedio, tomamos una cantidad de datos al azar como muestra, los sumamos y luego lo dividimos entre la cantidad de datos que tomamos, de all obtenemos el tiempo promedio.

13. Use the Time-Sequence-Graph(Stevens) plotting tool to view the sequence number versus time plot of segments being sent from the client to the gaia.cs.umass.edu server. Can you identify where TCPs slowstart phase begins and ends, and where congestion avoidance takes over? Comment on ways in which the measured data differs from the idealized behavior of TCP that weve studied in the text. El nmero de secuencia aumenta a razn del tiempo, cuando se enva un paquete el cliente, debe esperar la captura del servidor y esperar la respuesta, para transmitir el siguiente paquete. Este es el proceso que sigue TCP, para comunicar dos trasmisiones o trfico de paquetes. En caso de congestin, el bufer de memoria provoca rechazo del servidor y se detiene el envo de paquetes. 14. Answer each of two questions above for the trace that you have gathered when you transferred a file from your computer to gaia.cs.umass.edu Sigue el mismo proceso de lo respondido en las dos preguntas anteriores.

Prof. Giovana Garrido

ngel A. Morn G.

You might also like