b) The browser is running HTTP version 1.1, as indicated just before the first <cr><lf> pair.

Transcription

1 Prblem a) F b) T c) F d) F e) F Prblem 3 Applicatin layer prtcls: DNS and HTTP Transprt layer prtcls: UDP fr DNS; TCP fr HTTP Prblem 4 a) The dcument request was The Hst : field indicates the server's name and /cs453/index.html indicates the file name. b) The brwser is running HTTP versin., as indicated just befre the first <cr><lf> pair. c) The brwser is requesting a persistent cnnectin, as indicated by the Cnnectin: keep-alive. d) This is a trick questin. This infrmatin is nt cntained in an HTTP message anywhere. S there is n way t tell this frm lking at the exchange f HTTP messages alne. One wuld need infrmatin frm the IP datagrams (that carried the TCP segment that carried the HTTP GET request) t answer this questin. e) Mzilla/5.0. The brwser type infrmatin is needed by the server t send different versins f the same bject t different types f brwsers. Prblem 5 a) The status cde f 200 and the phrase OK indicate that the server was able t lcate the dcument successfully. The reply was prvided n Tuesday, 07 Mar :39:45 Greenwich Mean Time. b) The dcument index.html was last mdified n Saturday 0 Dec :27:46 GMT. c) There are 3874 bytes in the dcument being returned. d) The first five bytes f the returned dcument are : <!dc. The server agreed t a persistent cnnectin, as indicated by the Cnnectin: Keep-Alive field

2 Prblem 7 The ttal amunt f time t get the IP address is RTT + RTT2. Once the IP address is knwn, RTT O elapses t set up the TCP cnnectin and anther elapses t request and receive the small bject. The ttal respnse time is 2 RTT + RTT2 RTT O Prblem 8 a) b) c) RTT +!+ RTTn + 2RTT + 8 2RTT = 8RTT. RTT 2RTT +!+ RTTn + 2RTT + 2 = 6RTT RTT + + RTT + 2RTT + RTT! = 3 RTT. n Prblem 3 The MAIL FROM: in SMTP is a message frm the SMTP client that identifies the sender f the mail message t the SMTP server. The Frm: n the mail message itself is NOT an SMTP message, but rather is just a line in the bdy f the mail message. Prblem 4 SMTP uses a line cntaining nly a perid t mark the end f a message bdy. HTTP uses Cntent-Length header field t indicate the length f a message bdy. N, HTTP cannt use the methd used by SMTP, because HTTP message culd be binary data, whereas in SMTP, the message bdy must be in 7-bit ASCII frmat. Prblem 5 MTA stands fr Mail Transfer Agent. A hst sends the message t an MTA. The message then fllws a sequence f MTAs t reach the receiver s mail reader. We see that this spam

3 message fllws a chain f MTAs. An hnest MTA shuld reprt where it receives the message. Ntice that in this message, asusus-4b96 ([ ]) des nt reprt frm where it received the . Since we assume nly the riginatr is dishnest, s asusus-4b96 ([ ]) must be the riginatr. Prblem 8 a) Fr a given input f dmain name (such as ccn.cm), IP address r netwrk administratr name, the whis database can be used t lcate the crrespnding registrar, whis server, DNS server, and s n. b) NS4.YAHOO.COM frm NS.MSFT.NET frm ww.register.cm c) Lcal Dmain: Web servers : , , , , , , , Mail Servers : mx.mindspring.cm ( ) mx2.mindspring.cm ( ) mx3.mindspring.cm ( ) mx4.mindspring.cm ( ) Name Servers: itchy.earthlink.net ( ) scratchy.earthlink.net ( ) Web Servers: ( , ) Mail Servers: a.mx.mail.yah.cm ( ) b.mx.mail.yah.cm ( ) c.mx.mail.yah.cm ( , ) d.mx.mail.yah.cm ( ) e.mx.mail.yah.cm ( ) f.mx.mail.yah.cm ( , ) g.mx.mail.yah.cm ( , ) Name Servers: ns.yah.cm ( ) ns2.yah.cm ( ) ns3.yah.cm ( ) ns4.yah.cm ( ) ns5.yah.cm ( ) ns8.yah.cm ( ) ns9.yah.cm ( ) Web Servers: ( , )

4 Mail Servers: mx.htmail.cm ( , , ) mx2.htmail.cm ( , , ) mx3.htmail.cm ( , , ) mx4.htmail.cm ( , , ) Name Servers: ns.msft.net ( ) ns2.msft.net ( ) ns3.msft.net ( ) ns4.msft.net ( ) ns5.msft.net ( ) d) The yah web server has multiple IP addresses ( , ) e) The address range fr Plytechnic University: f) An attacker can use the whis database and nslkup tl t determine the IP address ranges, DNS server addresses, etc., fr the target institutin. g) By analyzing the surce address f attack packets, the victim can use whis t btain infrmatin abut dmain frm which the attack is cming and pssibly infrm the administratrs f the rigin dmain. Prblem 9 a) The fllwing delegatin chain is used fr gaia.cs.umass.edu a.rt-servers.net E.GTLD-SERVERS.NET ns.umass.edu(authritative) First cmmand: dig any gaia.cs.umass.edu ;; AUTHORITY SECTION: edu IN NS E.GTLD-SERVERS.NET. edu IN NS A.GTLD-SERVERS.NET. edu IN NS G3.NSTLD.COM. edu IN NS D.GTLD-SERVERS.NET. edu IN NS H3.NSTLD.COM. edu IN NS L3.NSTLD.COM. edu IN NS M3.NSTLD.COM. edu IN NS C.GTLD-SERVERS.NET. Amng all returned edu DNS servers, we send a query t the first ne.

5 dig any gaia.cs.umass.edu umass.edu IN NS ns.umass.edu. umass.edu IN NS ns2.umass.edu. umass.edu IN NS ns3.umass.edu. Amng all three returned authritative DNS servers, we send a query t the first ne. dig any gaia.cs.umass.edu gaia.cs.umass.edu IN A b) The answer fr ggle.cm culd be: a.rt-servers.net E.GTLD-SERVERS.NET ns.ggle.cm(authritative) Prblem 3 (6ème editin: Prblème 34) Fr an applicatin such as remte lgin (telnet and ssh), a byte-stream riented prtcl is very natural since there is n ntin f message bundaries in the applicatin. When a user types a character, we simply drp the character int the TCP cnnectin. In ther applicatins, we may be sending a series f messages that have inherent bundaries between them. Fr example, when ne SMTP mail server sends anther SMTP mail server several messages back t back. Since TCP des nt have a mechanism t indicate the bundaries, the applicatin must add the indicatins itself, s that receiving side f the applicatin can distinguish ne message frm the next. If each message were instead put int a distinct UDP segment, the receiving end wuld be able t distinguish the varius messages withut any indicatins added by the sending side f the applicatin.