SAVIO STEPHEN DSOUZA (SSD37)

Transcription

1 NEW JERSEY INSTITUTE OF TECHNOLOGY PROJECT REPORT DL- CS 656 INTERNET AND HIGHER LAYER PROTOCOLS DR. DIONISSIOS KARVELAS BY SAVIO STEPHEN DSOUZA (SSD37) 4/26/2013

2 DL-CS-656 Project If the version of Wireshark that you use has some default coloring rules, then each time you open it, you must first remove these default coloring rules before answering each one of the questions below. To do that, you click on View and select Coloring Rules. The Wireshark Coloring Rules window will open with the default coloring rules. You can click on the first coloring rule (top) then shift+click on the last one and Wireshark will select all of them. Then, you click on Delete and all coloring rules are removed. Finally, you simply click on Apply. Note that you can easily go back and restore the default coloring rules by simply clicking on Clear. Note that for question 1 you must use the provided file Ping.cap and for question 2 the provided file TCP.cap. 1. (4 points) I started Wireshark on host I selected non-promiscuous mode and started the packet capturing process. Next, I opened an MS-DOS Window by selecting Start, Run and entering cmd in the open box. Then, I pinged the remote host twice using: ping n 1 l 1000 afs1.njit.edu ping n 1 l 4000 afs1.njit.edu Note that -n 1 instructs ping to send one only ICMP Echo Request packet, where -l 1000 and -l 4000 indicate number of bytes; i.e., allow user select how big the echo request packet should be. After I had received the responses, I terminated Wireshark and saved the captured data to the provided file Ping.cap. Use Wireshark to open the Ping.cap file; you have to use this file to answer the questions not your own data. Then, remove the Wireshark default coloring rules and answer the following questions:

3 i) When you open the Ping.cap file you see that Wireshark has captured a lot more traffic than simply the ICMP requests and responses. This is due to other protocols running on my system and network. Apply a Display filter that will show only the traffic generated by the above two pings; both requests and responses. Type the filter you have used. Capture a screenshot of the Applied Display filter you have used and the resulting packet list pane that shows only the ping related traffic. The below screenshot is a result of the traffic generated by pinging the remote host twice. The filter used in here is, ip.addr== && icmp

4 ii) It was mentioned above, that the l 1000 option specifies number of bytes. Use the tree view pane (also called packet details pane) to examine this packet in detail and clarify what does the 1000 bytes refer to? The size of the ICMP request packet including the ICMP header? The ICMP data only? The size of the IP packet carrying the ICMP packet? The Ethernet frame that carries the IP packet with the ICMP packet inside? Capture a screenshot of the packet details pane that shows the packet fields that you have used to answer the question. The below given screenshot is a result when we try to explain in detail about the data which is 1000 bytes, which is the first ping to the remote host. The filter used is icmp

5 iii) The 2 nd ping above specifies a size of 4000 bytes. Since the underlying network is an Ethernet with an MTU of 1500 bytes, this 2 nd ICMP request packet will be fragmented. Compute (by hand) how many of the above 4000 bytes will be in each fragment. Show your computation. Do your computed values agree with the ones in the fields of the captured by Wireshark fragments? You must explain why or why not. Capture a screenshot of the packet details pane that shows the packet fields that you have used to answer the question. The Screenshot is a result of the second ping to the remote host which is of 4000 bytes, but Ethernet has an MTU of 1500 bytes, so it is divided into 3 fragments. IP Fragments (4008 bytes): #80(1480), #81(1480), #82(1048) Frame: 80, payload: (1480 bytes) Frame: 81, payload: (1480 bytes) Frame: 82, payload: (1048 bytes) The filter used is Ip.flags.mf==0 && ip.reassembles.length && ip.src==

6 iv) Use the colorization option of Wireshark to highlight the background of the last fragment of the 4000 bytes echo request packet. Capture a screenshot of the Wireshark Edit color filter dialog box with the selected filter value. Also type the filter that you have used. Capture, a screenshot of the resulting packet list pane where this last fragment is highlighted. The objective here is to identify this packet using properties that the last fragment has. So you must not use a filter that uses information that you could know only after you have identified the last fragment. For instance you cannot use a filter that uses the packet s message identification number, or its specific fragment offset value, or its total length value, or its sequence number, or its order (for example, packet number 54), etc. Below screenshot is given to show the last fragment of the 4000 bytes echo request packet The following filter is used: icmp.type==8 && ip.fragments We type the above filter in Edit Color Filter window. The following are all the screens that we see. The final snapshot shows the color that we selected for that packet.

7

8 2. (6 points) The provided file TCP.cap provides the traffic of different TCP connections between the hosts and Use Wireshark to open this file; you have to use this file to answer the questions. Remove the default coloring rules, and answer the following questions. i) Apply a Display Filter that will show only the TCP connect request packets of all TCP connections;. i.e., not connect responses or any other packet. Capture a screenshot of the applied filter and the corresponding packet list pane showing these packets. Also type the filter that you have used. What are the source and destination port numbers of each connection? The below screenshot shows us the TCP connect request packets of all the TCP connections. The source and destination port numbers of each connection is as follows: 1 st connection: - Source: 3600 Destination: 21 2 nd connection: -Source: 20 Destination: rd connection: - Source: 20 Destination: 3603 The filter used is tcp.flags.syn==1 && tcp.flags.ack==0 Below are the screen shot using this filter.

9

10 ii) Clear the previous filter so that the packet list pane shows again all packets. Apply a Display Filter that will show only the TCP connection release request packet of the 2 nd TCP connection. This is, the 1 st packet of the 3-way handshake that takes place during the Connection Termination phase; only the 1 st packet, not the response packet. Capture a screenshot of the applied filter and the corresponding packet list pane. Also type the filter that you have used. The Screenshot shows us the TCP connection release request packet of the 2nd TCP connection. The filter used here is tcp.flags.fin==1&&tcp.port==3602&& tcp.ack==1

11 iii) Clear the previous filter. Use the colorization option of Wireshark to highlight (use foreground color) only the TCP packets of the 2 nd TCP connection that carry data bytes; i.e. if a packet does not carry a data byte should not be highligted. Capture a screenshot of the Wireshark Edit color filter dialog box with the selected filter value. Also type the filter that you have used. Capture, a screenshot of the resulting packet list pane where these packets are highlighted. To highlight only the TCP packets of the 2nd TCP connection that carry data bytes we use the following filter in the colorization window ; ftp-data&&tcp.port==3602. The color window can be shown as :

12

13 iv) Clear the previous filter. Now focus on packet 51 st. Which packets does packet 51 st acknowledge? The question asks for packets that have not already been acknowledged by previous acknowledgements. Explain why; the answer should be something like: packet 51 acknowledges packets 41,42,43 because so and so (explain the reason) The packet 51 acknowledges the 45,47,48 packets because the sequences of the 45,47 and 48 are 11681, and respectively. Here we find that 46th packet sends the acknowledgement of the sequence and the other packets have the sequences greater than and less than So are included.

14 v) Find the total number of data bytes that were transmitted over the 2 nd TCP connection; data byte is considered any byte in the TCP packet payload; so if you have TCP header + something, this something is data bytes. You must not answer this question by simply finding the number of data bytes in each individual packet and then adding them up. This, for long data transfers, will be extremely time consuming. You must use a simple method that will work even if your data transfer consists of thousands of packets. Briefly describe the method that you have used and the corresponding value you have derived. The total number of data bytes that were transmitted over the 2nd TCP connection can be found by using the filter: ftp-data && tcp.port==3602 The total number data bytes is sequence of last packet-1+data of the last packet; = =

15 Rules For Submission: Provide a hardcopy of your answers and screenshots. You must type your answers. You must also provide a small caption above each screenshot explaining what the screenshot shows. If the answer is not typed or there is no caption, the corresponding question will not receive any points. Do not forget to include your name. In compliance with NJIT honor code, cheating is not allowed. This assignment is considered to be similar to an exam and it is not allowed to talk about its questions with other students; certainly copying from each other (or some other source) is NOT allowed. If there is the slightest evidence of copying, all students involved: a) will be penalized with a 0 grade in the assignment, b) their final letter grade will be lowered by one letter grade, c) their names will be sent to the Dean of students who may proceed with additional penalties. Who copied from whom is irrelevant; each student must ensure that no other student has access to his/her assignment.