b) The browser is running HTTP version 1.1, as indicated just before the first <cr><lf> pair.

Transcription

1 Prblem a) F b) T c) F d) F e) F Prblem 3 Applicatin layer prtcls: DNS and HTTP Transprt layer prtcls: UDP fr DNS; TCP fr HTTP Prblem 4 a) The dcument request was The Hst : field indicates the server's name and /cs453/index.html indicates the file name. b) The brwser is running HTTP versin., as indicated just befre the first <cr><lf> pair. c) The brwser is requesting a persistent cnnectin, as indicated by the Cnnectin: keep-alive. d) This is a trick questin. This infrmatin is nt cntained in an HTTP message anywhere. S there is n way t tell this frm lking at the exchange f HTTP messages alne. One wuld need infrmatin frm the IP datagrams (that carried the TCP segment that carried the HTTP GET request) t answer this questin. e) Mzilla/5.0. The brwser type infrmatin is needed by the server t send different versins f the same bject t different types f brwsers. Prblem 5 a) The status cde f 200 and the phrase OK indicate that the server was able t lcate the dcument successfully. The reply was prvided n Tuesday, 07 Mar :39:45 Greenwich Mean Time. b) The dcument index.html was last mdified n Saturday 0 Dec :27:46 GMT. c) There are 3874 bytes in the dcument being returned. d) The first five bytes f the returned dcument are : <!dc. The server agreed t a persistent cnnectin, as indicated by the Cnnectin: Keep-Alive field

2 Prblem 7 The ttal amunt f time t get the IP address is RTT + RTT2. Once the IP address is knwn, RTT O elapses t set up the TCP cnnectin and anther elapses t request and receive the small bject. The ttal respnse time is 2 RTT + RTT + RTT2 RTT O Prblem 8 a) b) c) RTT + + RTTn + 2RTT + 8 2RTT = 8RTT + RTT. RTT 2RTT + + RTTn + 2RTT + 2 = 6RTT + RTT RTT + + RTT + 2RTT + RTT = 3 RTT + RTT. n Prblem 3 The MAIL FROM: in SMTP is a message frm the SMTP client that identifies the sender f the mail message t the SMTP server. The Frm: n the mail message itself is NOT an SMTP message, but rather is just a line in the bdy f the mail message. Prblem 4 SMTP uses a line cntaining nly a perid t mark the end f a message bdy. HTTP uses Cntent- Length header field t indicate the length f a message bdy. N, HTTP cannt use the methd used by SMTP, because HTTP message culd be binary data, whereas in SMTP, the message bdy must be in 7- bit ASCII frmat. Prblem 5 MTA stands fr Mail Transfer Agent. A hst sends the message t an MTA. The message then fllws a sequence f MTAs t reach the receiver s mail reader. We see that this spam

3 message fllws a chain f MTAs. An hnest MTA shuld reprt where it receives the message. Ntice that in this message, asusus-4b96 ([ ]) des nt reprt frm where it received the . Since we assume nly the riginatr is dishnest, s asusus-4b96 ([ ]) must be the riginatr. Prblem 8 a) Fr a given input f dmain name (such as ccn.cm), IP address r netwrk administratr name, the whis database can be used t lcate the crrespnding registrar, whis server, DNS server, and s n. b) NS4.YAHOO.COM frm NS.MSFT.NET frm ww.register.cm c) Lcal Dmain: Web servers : , , , , , , , Mail Servers : mx.mindspring.cm ( ) mx2.mindspring.cm ( ) mx3.mindspring.cm ( ) mx4.mindspring.cm ( ) Name Servers: itchy.earthlink.net ( ) scratchy.earthlink.net ( ) Web Servers: ( , ) Mail Servers: a.mx.mail.yah.cm ( ) b.mx.mail.yah.cm ( ) c.mx.mail.yah.cm ( , ) d.mx.mail.yah.cm ( ) e.mx.mail.yah.cm ( ) f.mx.mail.yah.cm ( , ) g.mx.mail.yah.cm ( , ) Name Servers: ns.yah.cm ( ) ns2.yah.cm ( ) ns3.yah.cm ( ) ns4.yah.cm ( ) ns5.yah.cm ( ) ns8.yah.cm ( ) ns9.yah.cm ( ) Web Servers: ( , )

4 Mail Servers: mx.htmail.cm ( , , ) mx2.htmail.cm ( , , ) mx3.htmail.cm ( , , ) mx4.htmail.cm ( , , ) Name Servers: ns.msft.net ( ) ns2.msft.net ( ) ns3.msft.net ( ) ns4.msft.net ( ) ns5.msft.net ( ) d) The yah web server has multiple IP addresses ( , ) e) The address range fr Plytechnic University: f) An attacker can use the whis database and nslkup tl t determine the IP address ranges, DNS server addresses, etc., fr the target institutin. g) By analyzing the surce address f attack packets, the victim can use whis t btain infrmatin abut dmain frm which the attack is cming and pssibly infrm the administratrs f the rigin dmain. Prblem 9 a) The fllwing delegatin chain is used fr gaia.cs.umass.edu a.rt- servers.net E.GTLD- SERVERS.NET ns.umass.edu(authritative) First cmmand: dig servers.net any gaia.cs.umass.edu ;; AUTHORITY SECTION: edu IN NS E.GTLD- SERVERS.NET. edu IN NS A.GTLD- SERVERS.NET. edu IN NS G3.NSTLD.COM. edu IN NS D.GTLD- SERVERS.NET. edu IN NS H3.NSTLD.COM. edu IN NS L3.NSTLD.COM. edu IN NS M3.NSTLD.COM. edu IN NS C.GTLD- SERVERS.NET. Amng all returned edu DNS servers, we send a query t the first ne.

5 dig SERVERS.NET any gaia.cs.umass.edu umass.edu IN NS ns.umass.edu. umass.edu IN NS ns2.umass.edu. umass.edu IN NS ns3.umass.edu. Amng all three returned authritative DNS servers, we send a query t the first ne. dig any gaia.cs.umass.edu gaia.cs.umass.edu IN A b) The answer fr ggle.cm culd be: a.rt-servers.net E.GTLD-SERVERS.NET ns.ggle.cm(authritative) Prblem 2 Yes, we can use dig t query that Web site in the lcal DNS server. Fr example, dig cnn.cm will return the query time fr finding cnn.cm. If cnn.cm was just accessed a cuple f secnds ag, an entry fr cnn.cm is cached in the lcal DNS cache, s the query time is 0 msec. Otherwise, the query time is large. Prblem 22 Fr calculating the minimum distributin time fr client-server distributin, we use the fllwing frmula: D cs = max {NF/u s, F/d min } Similarly, fr calculating the minimum distributin time fr P2P distributin, we use the fllwing frmula: D P2 P = max{f/u s, F/d min, NF/(u Where, F = 5 Gbits = 5 * 024 Mbits u s = 30 Mbps d min = d i = 2 Mbps s + N i= ui)} Nte, 300Kbps = 300/024 Mbps. Client Server N Kbps

6 u 700 Kbps Mbps Peer t Peer N Kbps u 700 Kbps Mbps