计算机网络实验Ethernet and ARP.docx
《计算机网络实验Ethernet and ARP.docx》由会员分享,可在线阅读,更多相关《计算机网络实验Ethernet and ARP.docx(8页珍藏版)》请在冰豆网上搜索。
![计算机网络实验Ethernet and ARP.docx](https://file1.bdocx.com/fileroot1/2023-1/30/f35719e2-f753-4b3b-80f5-3a390d73e523/f35719e2-f753-4b3b-80f5-3a390d73e5231.gif)
计算机网络实验EthernetandARP
Lab7EthernetandARP
1.CapturingandanalyzingEthernetframes
STEPS
•First,makesureyourbrowser’scacheisempty.(TodothisunderNetscape7.0,selectEdit->Preferences->Advanced->Cacheandclearthememoryanddiskcache.ForInternetExplorer,selectTools->InternetOptions->DeleteFiles.ForFirefoxselectTools->ClearPrivateData.
•StartuptheWiresharkpacketsniffer
•EnterthefollowingURLintoyourbrowserhttp:
//gaia.cs.umass.edu/wireshark-labs/HTTP-ethereal-lab-file3.htmlYourbrowsershoulddisplaytheratherlengthyUSBillofRights.
•StopWiresharkpacketcapture.First,findthepacketnumbers(theleftmostcolumnintheupperWiresharkwindow)oftheHTTPGETmessagethatwassentfromyourcomputertogaia.cs.umass.edu,aswellasthebeginningoftheHTTPresponsemessagesenttoyourcomputerbygaia.cs.umass.edu.Youshouldseeascreenthatlookssomethinglikethis(wherepacket4inthescreenshotbelowcontainstheHTTPGETmessage)
•SincethislabisaboutEthernetandARP,we’renotinterestedinIPorhigherlayerprotocols.Solet’schangeWireshark’s“listingofcapturedpackets”windowsothatitshowsinformationonlyaboutprotocolsbelowIP.TohaveWiresharkdothis,selectAnalyze->EnabledProtocols.ThenunchecktheIPboxandselectOK.
QUESTIONS
1.Whatisthe48-bitEthernetaddressofyourcomputer?
The48-bitEthernetaddressofyourcomputeris3c:
97:
0e:
ff:
69:
02
2.Whatisthe48-bitdestinationaddressintheEthernetframe?
IsthistheEthernetaddressofgaia.cs.umass.edu?
(Hint:
theanswerisno).WhatdevicehasthisasitsEthernetaddress?
[Note:
thisisanimportantquestion,andonethatstudentssometimesgetwrong.Re-readpages468-469inthetextandmakesureyouunderstandtheanswerhere.]
The48-bitdestinationaddressintheEthernetframeis38:
22:
d6:
e6:
0e:
0d.Thisisn’ttheEthernetaddressofgaia.cs.umass.edu.ItistheEthernetaddressofmydefaultgateway.Thatistosay,it’stheaddressofmyrouter,whichisthelinkusedtogetoffthesubnet.
3.Givethehexadecimalvalueforthetwo-byteFrametypefield.Whatdothebit(s)whosevalueis1meanwithintheflagfield?
Thehexadecimalvalueforthetwo-byteFrametypefieldis0x0800.
Thebit(s)whosevalueis1withintheflagfieldmeanthefragmenthasnotbeenfragmented.
4.HowmanybytesfromtheverystartoftheEthernetframedoestheASCII“G”in“GET”appearintheEthernetframe?
54bytes.Thereare14bytesofEthernetframeheader,20bytesofIPheaderand20bytesofTCPheaderbeforeHTTPdata.Sotheansweris54bytes.
5.WhatisthehexadecimalvalueoftheCRCfieldinthisEthernetframe?
ThereisnoCRCfield.BecausetheCRCcalculatedbeforetheWiresharkpacketsnifferstartup.
6.WhatisthevalueoftheEthernetsourceaddress?
Isthistheaddressofyourcomputer,orofgaia.cs.umass.edu(Hint:
theanswerisno).WhatdevicehasthisasitsEthernetaddress?
ThevalueoftheEthernetsourceaddressis38:
22:
d6:
e6:
0e:
0d.Thisisneithertheaddressofmycomputer,norofgaia.cs.umass.edu.ItistheEthernetaddressofmydefaultgateway.Thatistosay,it’stheaddressofmyrouter,whichisthelinkusedtogetoffthesubnet.
7.WhatisthedestinationaddressintheEthernetframe?
IsthistheEthernetaddressofyourcomputer?
ThedestinationaddressintheEthernetframeis3c:
97:
0e:
ff:
69:
02.ThisistheEthernetaddressofmycomputer.
8.Givethehexadecimalvalueforthetwo-byteFrametypefield.Whatdothebit(s)whosevalueis1meanwithintheflagfield?
Thehexadecimalvalueforthetwo-byteFrametypefieldis0x0800.
Thebit(s)whosevalueis1withintheflagfieldmeanthefragmenthasnotbeenfragmented.
9.HowmanybytesfromtheverystartoftheEthernetframedoestheASCII“O”in“OK”(i.e.,theHTTPresponsecode)appearintheEthernetframe?
Thereare14bytesofEthernetframeheader,20bytesofIPheaderand20bytesofTCPheaderbeforeHTTPdata.
SotheHTTPdataappears54bytesfromtheverystartoftheEthernetframe.
ButbeforetheASCII“O”appears,thereare13bytes.SobeforetheASCII“O”appears,thereare67bytes.
10.WhatisthehexadecimalvalueoftheCRCfieldinthisEthernetframe?
ThereisnoCRCfield.BecausetheCRCcalculatedbeforetheWiresharkpacketsnifferstartup.
2.TheAddressResolutionProtocol
11.Writedownthecontentsofyourcomputer’sARPcache.Whatisthemeaningofeachcolumnvalue?
TheaddressofInternetcolumncontainstheIPaddress.ThephysicaladdresscolumncontainstheMACaddress.Thetypecolumntellsustheinformationabouttype:
dynamicorstatic.
STEPS
•ClearyourARPcache,asdescribedabove.
•Next,makesureyourbrowser’scacheisempty.(TodothisunderNetscape7.0,selectEdit->Preferences->Advanced->Cacheandclearthememoryanddiskcache.ForInternetExplorer,selectTools->InternetOptions->DeleteFiles.)
•StartuptheWiresharkpacketsniffer
•EnterthefollowingURLintoyourbrowserhttp:
//gaia.cs.umass.edu/wireshark-labs/HTTP-wireshark-lab-file3.htmlYourbrowsershouldagaindisplaytheratherlengthyUSBillofRights.
•StopWiresharkpacketcapture.Again,we’renotinterestedinIPorhigher-layerprotocols,sochangeWireshark’s“listingofcapturedpackets”windowsothatitshowsinformationonlyaboutprotocolsbelowIP.TohaveWiresharkdothis,selectAnalyze->EnabledProtocols.ThenunchecktheIPboxandselectOK.YoushouldnowseeanWiresharkwindowthatlookslike:
QUESTIONS
(Thefollowinganswersarebasedontheethernet-ethereal-trace-1tracefile)
12.WhatarethehexadecimalvaluesforthesourceanddestinationaddressesintheEthernetframecontainingtheARPrequestmessage?
ThehexadecimalvaluesforthesourceaddressesintheEthernetframeis00:
d0:
59:
a9:
3d:
68.ThehexadecimalvaluesforthedestinationaddressesintheEthernetframeisff:
ff:
ff:
ff:
ff:
ff.
13.Givethehexadecimalvalueforthetwo-byteEthernetFrametypefield.Whatdothebit(s)whosevalueis1meanwithintheflagfield?
Thehexadecimalvalueforthetwo-byteEthernetFrametypefieldis0x0806.
Thereisnoflagfield.
14.DownloadtheARPspecificationfromftp:
//ftp.rfc-editor.org/innotes/std/std37.txt.Areadable,detaileddiscussionofARPisalsoathttp:
//www.erg.abdn.ac.uk/users/gorry/course/inet-pages/arp.html.
a)HowmanybytesfromtheverybeginningoftheEthernetframedoestheARPopcodefieldbegin?
Thereare14bytesofEthernetframeheader.IntheARPdata,beforetheARPopcodefieldbegin,thereare6bytes.Sothereare20bytesbeforetheARPopcodefieldbegin.
b)WhatisthevalueoftheopcodefieldwithintheARP-payloadpartoftheEthernetframeinwhichanARPrequestismade?
ThevalueoftheopcodefieldwithintheARP-payloadpartoftheEthernetframeinwhichanARPrequestismadeis1.
c)DoestheARPmessagecontaintheIPaddressofthesender?
Yes,itcontains.Inhere,theIPaddressofthesenderis192.168.1.105.
d)WhereintheARPrequestdoesthe“question”appear–theEthernetaddressofthemachinewhosecorrespondingIPaddressisbeingqueried?
Thefield“TargetMACaddress”issetto00:
00:
00:
00:
00:
00toquestionthemachine’sEthernetaddresswhosecorrespondingIPaddress.
15.NowfindtheARPreplythatwassentinresponsetotheARPrequest.
a)HowmanybytesfromtheverybeginningoftheEthernetframedoestheARPopcodefieldbegin?
Thereare14bytesofEthernetframeheader.IntheARPdata,beforetheARPopcodefieldbegin,thereare6bytes.Sothereare20bytesbeforetheARPopcodefieldbegin.
b)WhatisthevalueoftheopcodefieldwithintheARP-payloadpartoftheEthernetframeinwhichanARPresponseismade?
ThevalueoftheopcodefieldwithintheARP-payloadpartoftheEthernetframeinwhichanARPresponseismadeis2
c)WhereintheARPmessagedoesthe“answer”totheearlierARPrequestappear–theIPaddressofthemachinehavingtheEthernetaddresswhosecorrespondingIPaddressisbeingqueried?
“SenderMACaddress”istheanswertotheearlierARPrequest.Inhere,itcontaintheMACaddressof192.168.1.1,whichis00:
06:
25:
da:
af:
73
16.WhatarethehexadecimalvaluesforthesourceanddestinationaddressesintheEthernetframecontainingtheARPreplymessage?
ThehexadecimalvaluesforthesourceaddressesintheEthernetframecontainingtheARPreplymessageis00:
06:
25:
da:
af:
73.
ThehexadecimalvaluesforthedestinationaddressesintheEthernetframecontainingtheARPreplymessageis00:
d0:
59:
a9:
3d;68.
17.Opentheethernet-ethereal-trace-1tracefileinhttp:
//gaia.cs.umass.edu/wireshark-labs/wireshark-traces.zip.ThefirstandsecondARPpacketsinthistracecorrespondtoanARPrequestsentbythecomputerrunningWireshark,andtheARPreplysenttothecomputerrunningWiresharkbythecomputerwiththeARP-requestedEthernetaddress.Butthereisyetanothercomputeronthisnetwork,asindiatedbypacket6–anotherARPrequest.WhyistherenoARPreply(sentinresponsetotheARPrequestinpacket6)inthepackettrace?
ThisabroadcastARPpacketsentby192.168.1.104.Soeveryhostinthesamesubnetwillreceivethepacket.ButtheARPistotryfindtheMACaddressof192.168.1.117.SoonlythehostwhichhavetheIPaddressof192.168.1.117willreply.Now“my”host’sIPaddressis192.168.1.105.So“my”hostwon’treply.And“my”hostdidn’treceivethereplypacket.SothereisnoARPreply(sentinresponsetotheARPrequestinpacket6)inthepackettrace.
ExtraCredit
EX-1.Thearpcommand:
arp-sInetAddrEtherAddrallowsyoutomanuallyaddanentrytotheARPcachethatresolves