计算机网络实验:Ethernet and ARP
更新时间:2023-09-30 20:56:01 阅读量: 综合文库 文档下载
- 计算机网络实验二实验报告推荐度:
- 相关推荐
Lab 7Ethernet and ARP
1. Capturing and analyzing Ethernet frames
STEPS
? First, make sure your browser’s cache is empty. (To do this under Netscape 7.0, select Edit->Preferences->Advanced->Cache and clear the memory and disk cache. For Internet Explorer, select Tools->Internet Options->Delete Files. For Firefox select Tools->Clear Private Data.
? Start up the Wireshark packet sniffer
? Enter the following URL into your browser
http://gaia.cs.umass.edu/wireshark-labs/HTTP-ethereal-lab-file3.html Your browser should display the rather lengthy US Bill of Rights.
? Stop Wireshark packet capture. First, find the packet numbers (the leftmost column in the upper Wireshark window) of the HTTP GET message that was sent from your computer to gaia.cs.umass.edu, as well as the beginning of the HTTP response message sent to your computer by gaia.cs.umass.edu. You should see a screen that looks something like this (where packet 4 in the screen shot below contains the HTTP GET message)
?Since this lab is about Ethernet and ARP, we’re not interested in IP or higherlayer protocols. So let’s change Wireshark’s “listing of captured packets” window so that it shows information only about protocols below IP. To have Wireshark do this, select Analyze->Enabled Protocols. Then uncheck the IP box and select OK.
QUESTIONS
1. What is the 48-bit Ethernet address of your computer?
The 48-bit Ethernet address of your computer is 3c : 97 : 0e : ff : 69 : 02
2. What is the 48-bit destination address in the Ethernet frame? Is this the Ethernet address of gaia.cs.umass.edu? (Hint: the answer is no). What device has this as its Ethernet address? [Note: this is an important question, and one that students
sometimes get wrong. Re-read pages 468-469 in the text and make sure you understand the answer here.]
The 48-bit destination address in the Ethernet frame is 38:22:d6:e6:0e:0d. This isn’t the Ethernet address of gaia.cs.umass.edu. It is the Ethernet address of my default gateway. That is to say, it’s the address of my router, which is the link used to get off the subnet.
3. Give the hexadecimal value for the two-byte Frame type field. What do the bit(s) whose value is 1 mean within the flag field?
The hexadecimal value for the two-byte Frame type field is 0x0800.
The bit(s) whose value is 1 within the flag fieldmean the fragment has not been fragmented.
4. How many bytes from the very start of the Ethernet frame does the ASCII “G” in “GET” appear in the Ethernet frame?
54 bytes. There are 14 bytes of Ethernet frame header, 20 bytes of IP header and 20 bytes of TCP header before HTTP data. So the answer is 54 bytes.
5. What is the hexadecimal value of the CRC field in this Ethernet frame?
There is no CRC field. Because the CRC calculated before the Wireshark packet sniffer start up.
6. What is the value of the Ethernet source address? Is this the address of your computer, or of gaia.cs.umass.edu (Hint: the answer is no). What device has this as its Ethernet address?
The value of the Ethernet source address is 38:22:d6:e6:0e:0d. This is neither the address of my computer, nor of gaia.cs.umass.edu. It is the Ethernet address of my default gateway. That is to say, it’s the address of my router, which is the link used to get off the subnet.
7. What is the destination address in the Ethernet frame? Is this the Ethernet address of your computer?
The destination address in the Ethernet frame is 3c : 97 : 0e : ff : 69 : 02. This is the Ethernet address of my computer.
8. Give the hexadecimal value for the two-byte Frame type field. What do the bit(s) whose value is 1 mean within the flag field?
The hexadecimal value for the two-byte Frame type field is 0x0800.
The bit(s) whose value is 1 within the flag fieldmean the fragment has not been fragmented.
9. How many bytes from the very start of the Ethernet frame does the ASCII “O” in “OK” (i.e., the HTTP response code) appear in the Ethernet frame?
There are 14 bytes of Ethernet frame header, 20 bytes of IP header and 20 bytes of TCP header before HTTP data.
So the HTTP data appears 54 bytes from the very start of the Ethernet frame. But before the ASCII “O” appears, there are 13 bytes. So before the ASCII “O” appears, there are 67 bytes.
10. What is the hexadecimal value of the CRC field in this Ethernet frame?
There is no CRC field. Because the CRC calculated before the Wireshark packet sniffer start up.
2. The Address Resolution Protocol
11. Write down the contents of your computer’s ARP cache. What is the meaning of
each column value?
The address of Internet column contains the IP address. The physical address column contains the MAC address. The type column tells us the information about type: dynamic or static.
STEPS
? Clear your ARP cache, as described above.
? Next, make sure your browser’s cache is empty. (To do this under Netscape 7.0, select Edit->Preferences->Advanced->Cache and clear the memory and disk cache. For Internet Explorer, select Tools->Internet Options->Delete Files.) ? Start up the Wireshark packet sniffer
? Enter the following URL into your browser http://gaia.cs.umass.edu/wireshark-labs/ HTTP-wireshark-lab-file3.html Your browser should again display the rather lengthy US Bill of Rights.
? Stop Wireshark packet capture. Again, we’re not interested in IP or higher-layer protocols, so change Wireshark’s “listing of captured packets” window so that it shows information only about protocols below IP. To have Wireshark do this, select Analyze->Enabled Protocols. Then uncheck the IP box and select OK. You should now see an Wireshark window that looks like:
QUESTIONS
(The following answers are based on the ethernet-ethereal-trace-1 trace file)
12.What are the hexadecimal values for the source and destination addresses in the Ethernet frame containing the ARP request message?
The hexadecimal values for the source addresses in the Ethernet frame is 00:d0:59:a9:3d:68.The hexadecimal values for the destination addresses in the Ethernet frame is ff :ff : ff : ff : ff : ff.
13. Give the hexadecimal value for the two-byte Ethernet Frame type field. What do the bit(s) whose value is 1 mean within the flag field?
The hexadecimal value for the two-byte Ethernet Frame type field is 0x0806. There is no flag field.
14.Download the ARP specification from ftp://ftp.rfc-editor.org/innotes/std/std37.txt. A readable, detailed discussion of ARP is also at http://www.erg.abdn.ac.uk/users/gorry/course/inet-pages/arp.html.
a) How many bytes from the very beginning of the Ethernet frame does the ARP opcode field begin?
There are 14 bytes of Ethernet frame header. In the ARP data, before the ARP opcode field begin, there are 6 bytes. So there are 20 bytes before the ARP opcode field begin.
b) What is the value of the opcode field within the ARP-payload part of the Ethernet frame in which an ARP request is made?
The value of the opcode field within the ARP-payload part of the Ethernet framein which an ARP request is made is 1.
c) Does the ARP message contain the IP address of the sender?
Yes, it contains. In here, the IP address of the sender is 192.168.1.105.
d) Where in the ARP request does the “question” appear – the Ethernet address of the machine whose corresponding IP address is being queried?
The field “Target MAC address” is set to 00:00:00:00:00:00 to question the machine’s Ethernet addresswhose corresponding IP address.
15.Now find the ARP reply that was sent in response to the ARP request.
a) How many bytes from the very beginning of the Ethernet frame does the ARP opcode field begin?
There are 14 bytes of Ethernet frame header. In the ARP data, before the ARP opcode field begin, there are 6 bytes. So there are 20 bytes before the ARP opcode field begin.
b) What is the value of the opcode field within the ARP-payload part of the Ethernet frame in which an ARP response is made?
The value of the opcode field within the ARP-payload part of the Ethernet frame in which an ARP response is made is 2
c) Where in the ARP message does the “answer” to the earlier ARP request appear – the IP address of the machine having the Ethernet address whose corresponding IP address is being queried?
“Sender MAC address” is the answer to the earlier ARP request. In here, it contain the MAC address of 192.168.1.1, which is 00:06:25:da:af:73
16.What are the hexadecimal values for the source and destination addresses in the Ethernet frame containing the ARP reply message?
The hexadecimal values for the source addresses in the Ethernet frame containing the ARP reply message is 00:06:25:da:af:73.
The hexadecimal values for thedestination addresses in the Ethernet frame containing the ARP reply message is 00:d0:59:a9:3d;68.
17. Open the ethernet-ethereal-trace-1 trace file in http://gaia.cs.umass.edu/wireshark-labs/wireshark-traces.zip. The first and second ARP packets in this trace correspond to an ARP request sent by the computer running Wireshark, and the ARP reply sent to the computer running Wireshark by the computer with the ARP-requested Ethernet address. But there is yet another computer on this network, as indiated by packet 6 – another ARP request. Why is there no ARP reply (sent in response to the ARP request in packet 6) in the packet trace?
This a broadcastARP packet sent by 192.168.1.104. So every host in the same subnet will receive the packet. But the ARP is to try find the MAC address of 192.168.1.117. So only the host which have the IP address of 192.168.1.117 will reply. Now “my” host’s IP address is 192.168.1.105. So “my” host won’t reply. And “my” host didn’t receive the reply packet. So there is no ARP reply (sent in response to the ARP request in packet 6) in the packet trace.
Extra Credit
EX-1. The arp command: arp -s InetAddrEtherAddr allows you to manually add an entry to the ARP cache that resolves the IP address InetAddr to the physical address EtherAddr. What would happen if, when you manually added an entry, you entered the correct IP address, but the wrong Ethernet address for that remote interface?
If I entered the correct IP address, but the wrong Ethernet address for that remote
interface, then I will get the wrong MAC address when I try to connect with the IP address that I entered. This is just like what happened in ARP spoofing.
EX-2. What is the default amount of time that an entry remains in your ARP cache before being removed.You can determine this empirically (by monitoring the cache contents) or by looking this up in your operation system documentation. Indicate how/where you determined this value.
In default, in Windows Server 2003 and Windows XP, the entry in the ARP cache will store 2 minutes. If an entry is used in this 2 minutes, the deadline will delay another 2 minutes until it have past 10 minutes. When an entry is stored for 10 minutes, then it must be removed.
正在阅读:
虚拟主机详情简介及虚拟主机应用技术04-30
培养兴趣 养成习惯11-18
2018年建设医德医风师范医院活动方案03-25
勤劳节俭作文400字07-02
基于51单片机的医院输液系统毕业设计10-27
游香港海洋公园记作文800字07-11
工作不顺心的经典语句精选02-15
清代名人故事02-18
村镇银行机构概览05-31
- 多层物业服务方案
- (审判实务)习惯法与少数民族地区民间纠纷解决问题(孙 潋)
- 人教版新课标六年级下册语文全册教案
- 词语打卡
- photoshop实习报告
- 钢结构设计原理综合测试2
- 2014年期末练习题
- 高中数学中的逆向思维解题方法探讨
- 名师原创 全国通用2014-2015学年高二寒假作业 政治(一)Word版
- 北航《建筑结构检测鉴定与加固》在线作业三
- XX县卫生监督所工程建设项目可行性研究报告
- 小学四年级观察作文经典评语
- 浅谈110KV变电站电气一次设计-程泉焱(1)
- 安全员考试题库
- 国家电网公司变电运维管理规定(试行)
- 义务教育课程标准稿征求意见提纲
- 教学秘书面试技巧
- 钢结构工程施工组织设计
- 水利工程概论论文
- 09届九年级数学第四次模拟试卷
- 计算机网络
- Ethernet
- 实验
- ARP
- 带式输送机发展现状及趋势
- 手法小切口白内障手术
- 保险代理人从业资格真题四 含答案
- 工程质量监理精细化管理实施细则
- 证据法学
- 中考数学一轮复习第五章图形的变换与尺规作图第2节平移和旋转试题
- 大学物理(下)练习题
- 《小组互助学习的探索与实践》课题结题报告
- 严蔚敏数据结构各章习题及答案
- 大学物理A第八章 电磁感应
- 05-案防知识题库-实务题30%
- 青岛版四年级下册书法练习指导教案
- 庭审观后感
- 2019-2020学年七年级数学下册 6 一元一次方程 6.3 实践与探索 2 储蓄问题学案(新版)华东师大版 doc
- 从关原合战东西军的选择说开来
- 教育均衡发展与四年级数学教学模式研究
- 2018-2024年中国吸塑机市场分析及发展策略研究预测报告
- 广告学作业(1)
- 南长街中心小学2018-2019学年三年级下学期数学模拟试卷含解析
- 国学中的管理智慧