CS 465 Networks. Disassembling Datagram Headers

Transcription

1 CS 465 Networks Disassembling Datagram Headers School of Computer Science Howard Hughes College of Engineering University of Nevada, Las Vegas (c) Matt Pedersen, 2006

2 Recall the first 5x4 octets of the Datagram header (We disregard the options and treat them like data for this assignment): VERS HLEN TOS TOTAL LENGTH IDENTIFICATION FLAGS TTL PROTOCOL HEADER CHECKSUM SOURCE IP ADDRESS DESTINATION IP ADDRESS In this assignment you must write a C program to analyze Datagrams. I have provided a file called datagram.txt (it can be found in/home/matt/cs465/assignment1 on bobby.cs.unlv.edu). It starts like this: cc a67f f e1f02772fbccc5c a0027ffff c a001c094f c cba7f f e1f2fdb17552fbccc5da0127fffa8e c a001c094f001c094f c ad7f f e1f02772fbccc5d2fdb fff a001c094f001c094f c b7f f e1f02772fb ccc5d2fdb fff1d a001c094f001c094f504f f f31 2e310d0a e ea97f f e1f2fdb17562fbccc6e80107ff f11f a001c094f001c094f c f f e1f02 772fbccc6e2fdb fffb0c a001c094f001c094f436f6e74656e742d4c656 e a d0a e1a ea87f f e1f2fdb17562f bccc fff11de a001c094f001c094f c b7f f e1f02772fbccc832fdb fff2f a001c094f001c094f436f6e74 656e742d a c f6e2f d0a The file does not contain any line-breaks or new-lines. It represents a continuous stream of variable length datagram that I grabbed off the network and encoded as hexadecimal numbers. This means, that one octet takes up 2 hex character, and a full 32 bit line takes up 8 characters. For example, the first 8 characters, when placed in the first 32 bit line of the datagram header, are: C The value of the last 2 octets represent the total length of the datagram, i.e. 3C 16 octets, which is You might want to consider the following two C procedures, which are useful for reading octets: int hexchar2int(unsigned char c) { if (c <= 9 ) return c 0 ; else return (c a )+10; } 1

3 int readoctet(file *f) { unsigned char h,l; 10 fscanf(f,"%c%c",&h,&l); return hexchar2int(h)*16+hexchar2int(l); } Study section in your text book and familiarize yourself with the format of the Datagram. For this assignment we regard the IP OPTIONS and the PADDING fields to be part of the DATA area. The datagram stream contains packets of different lengths, so you need to decode the first 32 bits of each datagram to determine the total length of the datagram. I suggest allocating an array of unsigned char to the maximum datagram size and then fill that array for each packet. If we assume this array is called buffer, to decode the VERS field of the header we could do the following: (buffer[0]&0xf0)>>4 which masks off the top 4 bits of the 8 bit unsigned char stored in buffer[0], and shifts them 4 places right: buffer[0] = = buffer[0] & 0xF0 = (buffer[0] & 0xF0)>>4 = = 4 10 You can represent SERVICE TYPE, FLAGS as integer values (i.e., no further decoding is necessary). The datagram stream contains packets from 3 different protocols, ICMP (PROTOCOL=1), UDP (PROTOCOL=17) and TCP (PROTOCOL=6). Keep in mind that if you are working on a x86 machine that numbers are represented using little endian, and that numbers in a datagram are represented in Network Byte Order (which happens to be big endian). This means you have to swap octets if you are decoding 16 bit integer numbers and performing bit manipulation or use the arithmetic of the executing machine to get the little endian representation automatically: if we have 2 octets A and B representing the high and the low order byte of a 16 bit number in Network Byte Order and we wish to decode these into a number on a little endian machine we have two options. 2

4 the resulting number is A 2 8 +B (we use the arithmetic of the target architecture to obtain the correct representation) the resulting bit pattern in little endian representing the correct number is ((B & 0x0f) << 8) ((A & 0x0f)). Note, that B appears before A in the final representation in little endian notation. Write a program that creates the output shown on the next page. In order to turn IP addresses into machine names you can use the gethostbyaddr function. See the man pages for further documentation. You can use sprintf to construct the IP address as a string to pass to inet addr (sprintf(src, %d.%d.%d.%d,...,...,...,...)). The complete output (which your program should produce) can be seen in the file output.txt. (Use tabs between columns) 3

5 Printed by Jun 01, 06 17: ass2.txt Page 1/5 Assignment 2: Add source and destination port information to UDP packets (Use your program from assignment 1). Here is the output on the sample input file: P.NAME VERS HLEN TOS TOTLEN ID FLAGS FRAG TTL PROTO CKSUM DATA SRC > DEST TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost UDP egr dns 1.egr.unlv.edu > donald duck.cs.unlv.edu Src port: 53 Dest port: UDP b173c.ce.unlv.edu > Src port: 138 Dest port: 138 UDP b173c.ce.unlv.edu > Src port: 137 Dest port: 137 UDP duckburg.cs.unlv.edu > donald duck.cs.unlv.edu UDP b173c.ce.unlv.edu > Src port: 137 Dest port: 137 UDP b173c.ce.unlv.edu > Src port: 137 Dest port: 137 Friday April 24, ass2.txt 1/5

6 Printed by Jun 01, 06 17: ass2.txt Page 2/5 UDP egr dns 1.egr.unlv.edu > donald duck.cs.unlv.edu Src port: 53 Dest port: TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost UDP egr dns 1.egr.unlv.edu > donald duck.cs.unlv.edu Src port: 53 Dest port: ICMP daimi.au.dk > donald duck.cs.unlv.edu Friday April 24, ass2.txt 2/5

7 Printed by Jun 01, 06 17: ass2.txt Page 3/5 UDP egr dns 1.egr.unlv.edu > donald duck.cs.unlv.edu TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost UDP egr dns 1.egr.unlv.edu > donald duck.cs.unlv.edu Src port: 53 Dest port: ICMP daimi.au.dk > donald duck.cs.unlv.edu UDP egr dns 1.egr.unlv.edu > donald duck.cs.unlv.edu UDP B348 server 2.EE.unlv.edu > Src port: 2519 Dest port: 2519 Friday April 24, ass2.txt 3/5

8 Printed by Jun 01, 06 17: ass2.txt Page 4/5 UDP > Src port: 68 Dest port: 67 ICMP daimi.au.dk > donald duck.cs.unlv.edu UDP egr dns 1.egr.unlv.edu > donald duck.cs.unlv.edu ICMP daimi.au.dk > donald duck.cs.unlv.edu UDP egr dns 1.egr.unlv.edu > donald duck.cs.unlv.edu ICMP daimi.au.dk > donald duck.cs.unlv.edu UDP egr dns 1.egr.unlv.edu > donald duck.cs.unlv.edu ICMP daimi.au.dk > donald duck.cs.unlv.edu UDP egr dns 1.egr.unlv.edu > donald duck.cs.unlv.edu UDP egr dns 1.egr.unlv.edu > donald duck.cs.unlv.edu TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost Friday April 24, ass2.txt 4/5

9 Printed by Jun 01, 06 17: ass2.txt Page 5/5 TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost TCP localhost > localhost 6 ICMP Packets ( 384 bytes data) 63 UDP Packets (8336 bytes data) 138 TCP Packets (6302 bytes data) Friday April 24, ass2.txt 5/5

10