Data Communication and Networks

profileabdulwahab97
HS1011Lab_TutorialActivityWeek6.docx
Home>Information Systems homework help>Data Communication and Networks

HS1011 Data Communication and Networks 13 August 2015

HS1011 Data Communication and Networks 13 August 2015

HOLMES

INSTITUTE

FACULTY OF HIGHER

EDUCATION

HS1011 Data Communication and Networks

Tutorial/Lab Activity Week 06

Network Models, Standards and Protocols

Hands-On Project 1: Identifying the TCP/IP Layers in a Frame

Objective: Capture packets and view the TCP/IP layers in the frame

Required Tools/Equipment: Your classroom computer with Wireshark installed

Description: In this project, you capture some frames generated by your Web browser and examine the captured frames to identify the TCP/IP layers.

1. Start Wireshark (Use “Wireshark manual” to learn “how to use wireshark to capture data”) and click Capture Options. In the Capture Filter text box, type tcp port http(see Figure 1), and then click Start.

Figure 1: Selecting filtering options

2. Start a Web browser, and open holmes website (http://www.holmes.edu.au/), exit the browser.

3. In Wireshark, click the Stop the running live capture toolbar icon to stop the capture. Scroll up to the first packet summary line, if necessary.

4. Click a packet summary in the top pane with HTTP in the protocol field and an Info line beginning with GET. In the middle pane are summaries of each protocol header (see Figure 5-6). You can ignore the first line starting with Frame X (with X representing the frame number), as it gives information about the frame, such as the time it arrived, its length, protocols in the frame, and so forth.

Figure 2: Summary of protocol headers in Wireshark

5. Click to expand the line beginning with Ethernet II. Examine the information in this header (discussed in more detail in the following sections). Write which layer of the TCP/IP model the Ethernet II header represents, and then click again to collapse this header:

_______________________________________________________________________________

6. Click to expand the line beginning with Internet Protocol. Examine the information in this header (discussed in more detail in the following sections). Write which layer of the TCP/IP model the Internet Protocol header represents, and then click again to collapse this header:

_______________________________________________________________________________

7. Click to expand the line beginning with Transmission Control Protocol. Examine the information in this header (discussed in more detail in the following sections). Write which layer of the TCP/IP model the Transmission Control Protocol header represents, and then click again to collapse this header:

_______________________________________________________________________________

8. Click to expand the line beginning with Hypertext Transfer Protocol, and examine the information. This data portion of the frame is what a Web server actually sees and responds to. In this case, the HTTP command is GET, which means HTTP is requesting a page (or part of a page) from the Web server. Write which layer of the TCP/IP model the HTTP protocol represents, and then click again to collapse this header:

_______________________________________________________________________________

9. Exit Wireshark and click Quit without Saving when prompted.

10. Close all open windows, but leave your computer running for the next project.

Hands-On Project 2: Capturing ARP and ICMP Packets

Objective: Use Wireshark to capture packets created by the Tracert program.

Required Tools/Equipment: Classroom computers with Wireshark installed

Description: In this project, you use Wireshark to capture ARP and ICMP packets generated by the Tracert program.

1. Open a command prompt window.

2. Type arp -d and press Enter to clear your ARP cache.

3. Start Wireshark(Use “Wireshark manual” to learn “how to use wireshark to capture data”) and click Capture Options. In the Capture Filter text box, type arp or icmp, and then click Start.

4. At the command prompt, type tracert books.tomsho.com and press Enter. When Tracert is finished, click theStop the running live capture toolbar icon in Wireshark to stop the capture. Scroll to the first packet summary line, if necessary.

5. Find the ARP packets your computer has generated by looking in the Info column for “Who has A.B.C.D, Tell 192.168.100.XX” (replacing A.B.C.D with the address of your default gateway and XX with your student number). Click this packet summary line.

6. Notice that the Dst (for destination) address is ff:ff:ff:ff:ff:ff, indicating a broadcast. In the middle pane, click to expand the Ethernet II line. Notice that the Type field is ARP (0x806), which tells

the Network access layer which Internetwork-layer protocol should receive the packet. Click again to collapse this line.

7. Click to expand the Address Resolution Protocol (request) line. Examine the information in the ARP header. The ARP message has fields to indicate what technology is used in the Network access layer (Ethernet) and the protocol type that needs the MAC address (IP, in this case). Click again to collapse this line.

8. Next, in the top pane, click the ARP reply message immediately following the ARP request. The Info column should be similar to “A.B.C.D is at 0A:1B:2C:3D:4E:5F.” The MAC address in the ARP reply is the MAC address of your default gateway. Explore the Network access and Internetwork headers for this frame. (Note: You might also find an ARP request and ARP reply for your DNS server if it's in the same network as your computer.)

9. In the top pane, click the first ICMP Echo (ping) request message from your computer to the destination computer at books.tomsho.com . The IP address should be 67.210.126.125, but IP addresses can change, so it might be different.

10. In the middle pane, click to expand the Internet Protocol line. Notice that the value in the Time to live line is 1.

11. In the top pane, click the ICMP Time-to-live exceeded message that follows the Ping request. This message was generated by the first router en route to books.tomsho.com . Notice that the source address is the address of your default gateway.

12. Find the next ICMP Echo (Ping) Request message and view the TTL value. Tracert sends three Echo Request messages for each TTL value, so the first three Echo Request messages have a TTL value of 1. Find the fourth ICMP Echo (Ping) Request message and view the TTL value, which should be 2. The Time-to-live exceeded message following it is from the next router down the line. Tracert follows this pattern until reaching the destination device ( books.tomsho.com ).

13. Exit Wireshark, but leave the command prompt window open if you're continuing to the next project.

Hands-On Project 3: Using the Netstat Program

Objective: Use the Netstat program to view network interface and IP protocol status and statistics.

Required Tools/Equipment: Your classroom computer

Description: In this project, you use Netstat to view statistics about your network interface and the IP protocol. Then you generate traffic with Ping and Tracert to see the statistics of different packet types change.

1. Open a command prompt window.

2. To display statistics about your Ethernet interface, type netstat -e and press Enter. These statistics include the number of bytes and packets received and sent through the Ethernet interface. If any errors are indicated in the display, you might have problems with your network connection that are slowing the network down. If the error packets approach 1% of the total number of packets, something is probably wrong with your NIC or physical interface.

3. To see statistics for all protocols, type netstat -s and press Enter. To limit the display to just IP statistics, type netstat -ps IP and press Enter.

4. To see your network statistics updated every 5 seconds, type netstat -ps IP 5 and press Enter. Press Ctrl+C to stop the program.

5. To display ICMP information, type netstat -ps ICMP and press Enter. A variety of ICMP message types are displayed along with how many of each type of message were received and sent. Most, if not all, will be Echo and Echo Reply messages.

6. Type ping 5.5.5.5 and press Enter. This command should generate ICMP Destination Unreachable messages. To see whether the number of Destination Unreachable messages has increased, type netstat -ps ICMP and press Enter.

7. The ICMP TTL-Expired messages used in Tracert are called Time Exceeded messages in Netstat. Type tracert books.tomsho.com and press Enter. To see whether the number of Time Exceeded messages has increased, type netstat -ps ICMP and press Enter.

8. To display your computer's routing table, type netstat -r and press Enter. Every computer has a routing table it uses to decide which interface to send packets to. The first entry lists the network destination as 0.0.0.0, which is the entry for your default gateway.

9. Leave the command prompt window open for the next project.

Tutorial/Lab Activity 5 Page 1 of 4

Tutorial/Lab Activity 5 Page 1 of 4

Page 4 of 4