Question

I had tried to work with the wireshark interface and cannot navigate it due to network problems and cannot find the question solutions, if any one can help with detailed steps it would be a great help.

Wireshark Lab #2: Ethernet In this lab, we'll investigate the Ethernet protocol and the ARP protocol. Before beginning this lab, you'l1 probably want to review sections 6.4.1 (Link-layer addressing and ARP) and 6.4.2 (Ethernet) in the text. RFC 826 (ftp://ftp.rfc-editor.org/in- notes/std/std37.txt) contains the gory details of the ARP protocol, which is used by an IP device to determine the IP address of a remote interface whose Ethernet address is known. 1. Capturing and analyzing Ethernet frames Let's begin by capturing a set of Ethernet frames to study. Do the following First, make sure your browser's cache is empty. To do this under Mozilla Firefox V3 select Tools->Clear Recent History and check the box for Cache. For Internet Explorer select Tools->Internet Options->Delete Files. Start up the Wireshark packet sniffer Enter the following URL into your browser http://gaia.cs.umass.edu/wireshark labs/HTTP-ethereal-lab-file3.html Your browser should display the rather lengthy US Bill of Rights . Stop Wireshark packet capture. First, find the packet numbers (the leftmost column in the upper Wireshark window) of the HTTP GET message that was sent from your computer to gaia.cs.umass.edu, as well as the beginning of the HTTP response message sent to your computer by gaia.cs.umass.edu. You should see a screen that looks something like this (where packet 4 in the screen shot below contains the HTTP GET message) Answer the following questions, based on the contents of the Ethernet frame containing the HTTP GET message. Whenever possible, when answering a question you should hand in a printout of the packet(s) within the trace that you used to answer the question asked. Annotate the printout' to explain your answer. To print a packet, use File->Print, choose Selected packet only, choose Packet summary line, and select the minimum amount of packet detail that you need to answer the question. 1. 2. What is the 48-bit Ethernet address of your computer? What is the 48-bit destination address in the Ethernet frame? Is this the Ethernet address of gaia.cs.umass.edu? (Hint: the answer is no). What device has this as its Ethernet address? [Note: this is an important question, and one that students sometimes get wrong. Re-read pages 468-469 in the text and make sure you understand the answer here 3. Give the hexadecimal value for the two-byte Frame type field. What upper layer protocol 4. How many bytes from the very start of the Ethernet frame does the ASCII "G in "GET" Next, answer the following questions, based on the contents of the Ethernet frame containing the does this correspond to? appear in the Ethernet frame? first byte of the HTTP response message. 5. What is the value of the Ethernet source address? Is this the address of your computer, or of gaia.cs.umass.edu (Hint: the answer is no). What device has this as its Ethernet address? 6. What is the destination address in the Ethernet frame? Is this the Ethernet address of your 7. Give the hexadecimal value for the two-byte Frame type field. What upper layer protocol 8. How many bytes from the very start of the Ethenet frame does the ASCII "O" in "OK" computer? does this correspond to? (i.e., the HTTP response code) appear in the Ethernet frame?

Answer 1

1. What is the 48-bit Ethernet address of your computer? Answer "Local Area Connection [Wireshark 1.10.6 (v1.10.6 from master-1.10) Eile Edit Yiew Go Cepture Analyze Statistics Telephony Iools Internals Help 0 4 ■de:) x e a**ウ了么 5) aaami.団思%!@ Protocol Length Info 18 0.10276600 vmware_b4:cb:20 Tp-LinkT_f8:6d:f9 x0800 433 IP 19 0.10278100 Vmware b4:cb:20 Tp-LinkT f8:6d:f9 0x0800 433 IP 20 0.14086000 Tp-LinkT f8:6d:f9 Vmware b4:cb:20 0x0800 94 IP 21 0.14159000 Vmware b4:cb:20 Tp-LinkT_f8:6d:f9 Ox0800 62 IP 22 0.14160600 Vmware b4:cb:20 Tp-LinkT f8:6d:f9 0x0800 62 IP 23 0.14335400 Tp-LinkT f8:6d:f9 vmware b4:cb:20 Ox0800 114 IP 24 0.14379600 Vmware b4:cb:20 pLinkT f8:6d:f9 Ox0800 62 IP 25 0.14382200 Vmware b4:cb:20 Tp-LinkT f8:6d:f9 0x0800 62 I 26 0.17022500 Tp-LinkT f8:6d:f9 Vmware b4:cb:20 Ox0800 62 IP 27 0.17038600 Vmware b4:cb:20 Tp-LinkT f8:6d:f9 0x0800 54 IP Ethernet 田Destination : vmware-b4 : СЬ:20 Tp-Link (00:0c : 29.b4 : Cb:20. (a0:f3c1 : f8:6d:f9) B 11, src: Dst : Tp-LinkT-f8:6df9 (ao : f 3: C1 : f8:6d:f9) 8:6d : f9 Source: Vmware_b4:cb:20 (00:0c:29:b4:cb:20) g Data (419 bytes) a3 11 bd 40 00 80 06 00 00 co a8 01 0b 80 Oc fe 28 00 50 db c0 93 06 57 c5 83 35 50 a fo 38 cd 00 00 47 45 54 20 2f 77 69 72 65 73 8 61 72 6b 2d 6c 61 62 73 2f 48 54 54 50 2d 6 68 65 72 65 61 6c 2d 6c 61 62 2d 66 69 6 2e 68 74 6d 6c 20 48 54 54 50 2f 31 2e 31 48 6f 73 74 3a 20 67 61 69 61 2e 63 73 2e 61 73 73 2e 65 64 75 Od 0a 43 6f 6e 6e 65 63 469 6f 6e 3a 20 6b 65 65702d61 6c 69 76 65 Oa 41 63 63 65 70 74 3a 20 74 65 78 74 2f 6 4 6d 6c 2c 61 70 70 6c 69 63 61 74 69 6f 6e 2f 74 6d 6c 2b 78 6d 6c 2c 61 70 70 6c 69 Frame (frame). 433 bytes Packets: 55 . Displayed: 55 (1000%) . Dropped:〇(0 Profile Default Figure 1 According to above screenshot (Figure 1), the Ethernet address of my computer is 00:0c:29:b4:cb:20 2. What is the 48-bit destination address in the Ethernet frame? Is this the Ethernet address of gaia.cs.umass.edu? (Hint: the answer is no). What device has this as its Ethernet address? Note: this is an important question, and one that students sometimes get wrong. Re-read pages 468-469 in the text and make sure you understand the answer here.] Answer

  

According to Figure 1, the destination address is a0:f3:c1:f8:6d:f9. This address is not the etherrnet address of gaia.cs.umass.edu, but it is the address of my TP link router (Gateway to Internet) 3. Give the hexadecimal value for the two-byte Frame type field. What upper layer protocol does this correspond to? Answer According to the Figure 1, the hexadecimal value for the frame type field is Type: IP (0x0800) This is correspond to IP protocol 4. How many bytes from the very start of the Ethernet frame does the ASCII "G" in "GET" appear in the Ethernet frame? Answer According to the Figure 1, the G in the GET appears 52 bits into the frame 5. What is the value of the Ethernet source address? Is this the address of your computer, or of gaia.cs.umass.edu (Hint: the answer is no). What device has this as its Ethernet address? 30 0.20547700 Tp-LinkT_f8:6d:f9 Vmware b4:cb:20 Ox0800 1514 IP 困Frame so: 1,14 bytes on wn re (12111 曰Ethernet 11, Src: Tp-LinkT-f8 : 6d : f9 DI ts), 1,14 bytes capturea (11111 Dts) on Interrace u (a0:f3:C1 : f 8 : 6d : f9), DSt : vmware-b4 : cb : 20 (00:0c :29 : b4 : cb :20) В Destination : vmware-b4 : cb : 20 (00:0c : 29 : b4 : cb : 20) Address: vmware b4:cb:20 (00:0c:29:b4:cb:20) a Source: Tp-LinkT f8:6d:f9 (a0:f3:cl:f8:6d:f9) Address: Tp-LinkT f8:6d:f9 (a0:f3:c1:f8:6d:f9) ...0.... IG bit Individual address (unicast) Type: IP (0x0800) E Data (1500 bytes) Data: 450005dc479140002d06c9538077f 50ccOa8010b0050fe28 Length: 1500 0000 00 Oc 29 b4 cb 20 a0 f3 cl f8 6d f9 08 00 0010 0020 0030 0040 5dC 47 91 40 00 2d 06 c9 53 80 7 1 Ob 00 50 fe 28 57 C5 83 35 db co 94 81 50 1 9 20 a3 7c 00 00 48 54 54 50 2f 31 2e 31 20 3 30 30 20 4f 4b 0d 0a 44 61 74 65 за 20 4d 6f 6 O OK.. D ate: Mor Figure 2 According to the Figure 2, the value of the Ethernet source address is a0:f3:c1:f8:6d:f9. This address is not the address of my computer or gaia.cs.umass.edu. This is the address of my router

6. What is the destination address in the Ethernet frame? ls this the Ethernet address of your computer? Answer According to the Figure 2, the value of the destination address is 00:0c:29:b4:cb:20. This is the address of my computer. Local network card information Ethernet adapter Local Area Connection: Connection-specific DNS Suffix .: Description . . . . . . . . . . . : Inte1(R) PRO/1000 MT Network Connection Physical Address 00-GC-29-B4-CB-20 Autoconfiguration Enabled . : Yes Subnet Mask Default Gateway. . . 255.255.255.0 : 192.168.1.1 DNS Servers : 8.8.8.8 7. Give the hexadecimal value for the two-byte Frame type field. What upper layer protocol does this correspond to? Answer According to the Figure 2, the hex value of this field is 0x0800. It corresponds to the IP protocol 8. How many bytes from the very start of the Ethernet frame does the ASCI"O" in "OK" (i.e., the HTTP response code) appear in the Ethernet frame? Answer According to the Figure 2, the O in OK appear 52 bytes in the Ethernet frame

If you like my work then plz give a like it will really appreciate.