Trp. Trp. Master Informatique 1 st year 1 st term. ARes/ComNet Transport layer (7 points) Anonymous ID: stick number HERE

Transcription

1 Master Informatique 1 st year 1 st term Anonymous ID: stick number HERE Master Informatique 1 st year 1 st term App ARes/ComNet Midterm exam : Version A in English Duration: 2h00 Allowed: One handwritten A4 sheet (front and back) Forbidden: All other documents, pocket calculators, mobile phones, etc. App The exam consists of 3 sheets recto/verso, including the questions and spaces in which to write your answers. You must hand back only these sheets at the end of the exam. To ensure anonymity, you must not write your name on the exam. Be absolutely sure that the anonymous ID number assigned to you by the exam supervisors appears on each sheet. You must write your answers in the frames provided for that purpose. QUIT Bye 1. What is the application? What is the software used for this application? What is the user doing with this application? What is the protocol used at the application layer? 2. What are the protocol s commands that we can see in this exchange? 1 Applications (6 points) Analyze the following message exchange between a client and a server. The messages have been intercepted at the Application layer. 220 mail.etu5.plateforme.lan ESMTP Postfix (Debian/GNU) EHLO [ ] 250-mail.etu5.plateforme.lan 250-PIPELINING 250-SIZE VRFY 250-ETRN 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN MAIL FROM:<etudiant@mail.etu5.plateforme.lan> Ok RCPT TO:<etudiant@mail.etu5.plateforme.lan> Ok DATA 354 End data with <CR><LF>.<CR><LF> Subject: Test From: etudiant on VM3 <etudiant@mail.etu5.plateforme.lan> To: etudiant@mail.etu5.plateforme.lan Content-Type: text/plain Date: Wed, 01 Oct :05: Message-ID: < camel@5vm1.etu5.plateforme.lan> Mime-Version: 1.0 X-Mailer: Evolution Content-Transfer-Encoding: 7bit Bonjour de Jussieu What is the IP address of the client? What is the DNS name of the mail server? What is the sender s address? What is the receiver s address? 4. What are the headers indicating that the follows the MIME format? What is the purpose of MIME? What is the encoding used to send the message content over the network? What is the header indicating this encoding type? 5. What is the message s subject? What is the message s content? 6. It is possible to connect to the server using Telnet to do the same thing that we have analyzed? Give the command line which allows the user to log on the server to do that. 7. If the user used web mail to send the message, what would be the Application layer protocol used between the client and the server? With this protocol, what would have been the commands used? Ok: queued as E6 RSET Ok 1/12 Version X en-vA-b 2/12 Version X en-vA-b

2 Master Informatique 1 st year 1 st term Anonymous ID: stick number HERE Master Informatique 1 st year 1 st term Trp ARes/ComNet Midterm exam : Version A in English Duration: 2h00 Allowed: One handwritten A4 sheet (front and back) Forbidden: All other documents, pocket calculators, mobile phones, etc. Trp The exam consists of 3 sheets recto/verso, including the questions and spaces in which to write your answers. You must hand back only these sheets at the end of the exam. To ensure anonymity, you must not write your name on the exam. Be absolutely sure that the anonymous ID number assigned to you by the exam supervisors appears on each sheet. You must write your answers in the frames provided for that purpose. 2 Transport layer (7 points) 6. Two segments have a PUSH bit set (one at the beginning, the other at the end of the trace). What is their role (justify)? Client 8,7 8,9 9,1 9, Serveur On the basis of the TCP trace given in Appendix 2 (page 9), answer the following questions: 1. What is the server address, the client address (justify)? 9,5 9,7 7. At connection setup, MSS options with value of 1460 are exchanged, but in the trace that follows the maximum size of the payload is 1448 bytes. Why (justify)? 9,9 2. What action by the user will have initiated this trace (justify)? 10,1 10,3 10,5 3. Is the protocol analyser that has captured this trace close to the client or to the server (justify)? 8. What is the average throughput observed over the entire connection (justify)? 10,7 10,9 11,1 4. Four options (other than nop or eol) are exchanged during the connection setup. What is each one for? Explain how each one works. 5. What is the RTT that we can observe at the beginning of the connection (justify)? 9. Complete the following chronogram of exchanges, strictly respecting the provided time scale temps (s) 11,3 3/12 Version X en-vA-b 4/12 Version X en-vA-b

3 Master Informatique 1 st year 1 st term Anonymous ID: stick number HERE Master Informatique 1 st year 1 st term Frm ARes/ComNet Midterm exam : Version A in English Duration: 2h00 Allowed: One handwritten A4 sheet (front and back) Forbidden: All other documents, pocket calculators, mobile phones, etc. Frm The exam consists of 3 sheets recto/verso, including the questions and spaces in which to write your answers. You must hand back only these sheets at the end of the exam. To ensure anonymity, you must not write your name on the exam. Be absolutely sure that the anonymous ID number assigned to you by the exam supervisors appears on each sheet. You must write your answers in the places provided for that purpose. 1. Is the frame above carrying a query or a request message? Give three arguments that justify your choice (from the frame). Type: (a) (b) (c) 2. How many IP addresses appear in the frame above? What is the significance of each address? 3 Multi-protocol analysis (7 points) Decode the following frame. Draw and write directly on it. Carefully delimit each protocol field and provide an accurate interpretation of its value. You may refer to the Appendix 1 (page 7) to help in the analysis f f3 fb fe f e ^..T..E. 3. The frame that you have decoded is part of an exchange. If the frame was sent in response to another frame, generate the corresponding query frame. If, on the other hand, the frame was a query frame, generate the corresponding response frame. Just write out the first 70 bytes of the frame, two hexadecimal digits to a box. (If you cannot deduce the value in a box, leave it blank.) a4 d f 11 2e e3 4a e3...?..)..j e d ed f T..5.d...h... Byte num c lequipe.f c0 0c r...d a0 5c 6c b2 c0 0c \l...Y e 03 6e f e ns3.atos.net. 4. The same application layer action that triggered the previous frames will be executed after 10 minutes. Explain what will be the result of this new action? Justify your answer c0 0c e Y...ns c0 3c c f eb c1 38.<.R.../ e f8 c f eb a0 5c /...\ 00a y. 5/12 Version X en-vA-b 6/12 Version X en-vA-b

4 Don t hand back this sheet! Don t hand back this sheet! Appendix 1 Ethernet Frame Layout without preamble/crc: bits bits--+16b Destination Source Type Data address address A few types: 0x0800 = DoD Internet (IPv4) 0x0806 = ARP 0x86DD = Internet Protocol Version 6 (IPv6) IPv4 Paquet Layout <-4b-> <--8bits--->< bits > Ver IHL TOS Total Length Identifier Fl FO TTL Protocol Header Checksum Source Address Destination Address... Options... Data TCP Segment Layout <-4b-> <-6bits->< bits > Source Port Destination Port Sequence Number Acknowledgement Number THL Flag Windows Size Segment Checksum Urgence Pointer... Options... Data THL = TCP header length on 4 bits (32 bits words) Flags on 6 bits (from most significant bit to less) = < URG, ACK, PSH, RST, SYN, FIN > Options = series of options encoded as: 1 byte 00 = end of options (if needed) 1 byte 01 = no operation L bytes with TLV fields (T one byte of type: 2 = negotiate MSS 3 = adaptation of window size 4 = selective acknowledgment 8 = timestamps... L one byte for the total size of the option V the value of the option on L-2 bytes) UDP Datagram Layout A querry: <-----N-Bytes-----><2-Bytes><2-Bytes> Name Type Classe An Answer/AutoritativeNS/AdditionalRecord: <M-Bytes>< 2B. >< 2B. ><4-Bytes>< 2B. ><--D-Bytes---> Name Type Classe T.T.L. Size Data * Name : each domain name is preceded by one byte showing the number of following ASCII characters (if the value is < 63 else the value 0xC0 show a reference to the offset value of the next byte (from the beginning of the message) Ending by 0x00. * A few types: 1 = A (IPv4 Address) 12 = PTR (Name Pointer) 2 = NS (Name Server) 15 = MX (Mail Server) 5 = CNAME (Alias) 28 = AAAA (IPv6 Address) 6 = SOA (Start Of Authority)... * Classe: 1 = Internet * T.T.L.: Cache Validity (seconds) * Size: Data length in Bytes * Data: - Name (Character string as for a query) for NS - Priority (2 bytes) and Name for MX - Address (4 bytes for A, 16 bytes for AAAA)... Ver = IP Version IHL = IP Header Length (32 bits words) TOS = Type of service Total Length of the IP paquet (in bytes) Fl (3 left bits) = fragmentation flags [Reserved Don t Fragment Next Fragment] FO (remaining 13 bits) = Fragment Offset * value to multiply by 8 bytes TTL = Time To Live (hop count) A few protocol fields: 1 = ICMP 33 = DCCP 2 = IGMP 41 = IPv6 Encapsulation 6 = TCP 89 = OSPF 8 = EGP 132 = SCTP 17 = UDP... ICMP Datagram Layout Source Port Destination Port Longueur UDP Datagram Checksum... Data A few ports associated services ftp-data 20/tcp domain 53/udp ftp 21/tcp tftp 69/udp ssh 22/tcp snmp 161/udp telnet 23/tcp snmp-trap 162/udp smtp 25/tcp www 80/tcp Type Code Datagram Checksum Variable... Original Datagram + 8 Bytes A few ICMP types: 0 = Echo response 3 = Destination Unreachable 5 = Redirection 8 = Echo request 11 = Time exceed DNS Messages Layout < 2B.>< 2B.><2B.><2B.><2B.><2B.>< qb.>< ab.>< nb.>< ib.> Ident Flags NbQu NbAn NbNS NbAR Quer. Ans. AutNS. AddR * Ident. = Request Identifier * Flags = DNS parameters (don t explain) * NbQu = Number of Queries * NbAn = Number of Answers * NbNS = Number of Autoritative Name Server * NbAR = Number of Additional Reccords 7/12 Version X en-vA-b 8/12 Version X en-vA-b

5 Don t hand back this sheet! Don t hand back this sheet! Appendix :2000 > :80 S 0(0) win <mss 1460,nop,wscale 3,nop,nop,timestamp 373 0,sackOK,eol> :80 > :2000 S 0(0) ack 0 win 5792 <mss 1460,sackOK,timestamp ,nop, wscale 7> :2000 > :80. ack 1 win <nop,nop,timestamp > :2000 > :80 P 1(586) ack 1 win <nop,nop,timestamp > :80 > :2000. ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :2000 > :80. ack 2897 win <nop,nop,timestamp > :2000 > :80. ack 4345 win <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :2000 > :80. ack 5793 win <nop,nop,timestamp > :2000 > :80. ack 8689 win <nop,nop,timestamp > :2000 > :80. ack win <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :2000 > :80. ack win <nop,nop,timestamp > :2000 > :80. ack win <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :2000 > :80. ack win <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :2000 > :80. ack win <nop,nop,timestamp > :2000 > :80. ack win <nop,nop,timestamp > :2000 > :80. ack win <nop,nop,timestamp > :2000 > :80. ack win <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :2000 > :80. ack win <nop,nop,timestamp > :2000 > :80. ack win <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > : (1448) ack 587 win 55 <nop,nop,timestamp > :80 > :2000 FP 56473(893) ack 587 win 55 <nop,nop,timestamp > :2000 > :80. ack win <nop,nop,timestamp > :2000 > :80 F 587(0) ack win <nop,nop,timestamp > :80 > :2000. ack 588 win 55 <nop,nop,timestamp > 9/12 Version X en-vA-b 10/12 Version X en-vA-b

6 Don t hand back this sheet! Don t hand back this sheet! 11/12 Version X en-vA-b 12/12 Version X en-vA-b