wireshark3_TCP

1、重庆大学软件学院实验报告实验名称利用 Wireshark分析TCP协议课程名称计算机网络与通信姓名成绩学号教师胡海波班级日期 2013-04-29计算机网络与通信实验报告开课实验室:年 月 日姓名年级、班级成绩实验（项目）名称实验三：利用 Wireshark分析TCP协议指导教师胡海波教 师 评 语教师签名：胡海波年 月日、实验目的1、熟悉TCP协议的基本原理2、利用 WireShark对TCP协议进行分析二、使用的软件、硬件1.接入In ternet的计算机2.抓包工具WireShark3.wi ngdows 7 自带的截图工具三、实验过程原始记录(数据、图表、计算等)1. What is

2、the IP address and TCP port nu mber used by the clie nt compu ter (source)that is tran sferri ng Jhe file to ?± Header checksum: 0x0000 ncorrecx, should be source: 31 (31) Destination: 123,119*245.12119. 245,12)Source GeoIP: unknownDestination GeoiP: unk

3、nowniTransmission control Protocol, src Port: health source port: hea1th-trap (1162Desri nation port: http (80)Answer： IP address :31 TCP port number :11622. What is the IP address of ? On what port number is it sending and receivi ng TCP segme nts for this connection?An

4、swer： IP address of is 128.119.245,23ort number is 803. What is the IP address and TCP port nu mber used by your clie nt compu ter (source) to tran sfer the file to ?Answer： IP address : 31, TCP port number : 11624. What is the sequenee number of the TC

5、P SYN segment that is used to the TCP connection between the client computer and ? is itin the segme nt that ide ntifies the segme nt as a SYN segme nt?in itiateWhatport httpAnswer： sequenee number of the TCP SYN segment is 1 .5. What is theseque neenumber of the SYNACK segme ntgaia

6、.to the clie nt compu ter in reply to the SYN? What is the value of theACKno wledgeme nt field in the SYNACK segme nt? How did determinethat value? What is it in the segment that identifiesas a SYNACK segme nt?Acknowledgment number: 1 Cre1ative ack number)thesent bysegm

7、e nt6. What is the seque nee nu mber of the TCP segme nt containing the HTTP POST comma nd?sequence number: 1 (relative sequence number)Next sequence number: 719 (relative sequence number)7. Con sider the TCP segme nt containing the HTTP POST as the first segme nt in the TCP connection. What are the

8、 sequenee numbers of the in theTCP co nn ectio n (in cludi ng the segme nt con tai ning the HTT P PO ST)? Atwhat time was each segment sent? When was the ACK for each Give n the differe nee betwee n whe n each TCP segme nt was sent, and whe n its ack no wledgeme nt was received, what is the RTT valu

9、e for each of the six segme nts? What is the EstimatedRTT value (see p age 249 in text) after the recei pt of each ACK?firstsixsegme ntsegme ntsreceived?10.253.176. ag12& 119.245.1?TCP7410.2S3.176. 391ZS.119. 245.12TCP7412S.115. 245.1210.253.176. 35TCP7410.2S3.176.12S.119. 245.1?TCP6610.253.176.

10、 392TCP2058IQ. 253.17旨.3944TTP748. What is the length of each of the first six TCP segments?9. What is the minimum amount of available buffer space advertised at the receivedfor the en tire trace? Does the lack of receiver buffer space everthrottlethesenr?cal cul atedwindow

11、51ze: 5792any retransmitted10. Are therefor (in the trace) in order to an swer this questi on?segmentsin the trace file?What didyou checkS ekpert Info (chat/sequence) : Cornection establish acknoh-1 edge (SYN+ACK): server Message : Connection lestablish adcnEnwledge CSYN+ACK): server port http sever

12、ity level: chat g广up: Sequence-4 -in an ACK? Can you11. How much data does the receivertyp icallyack no wledgeiden tify cases where the receiver is ACKi ng every other received segme nt (see Table 3.2 on p age 257 in the text).28582651 2858222S5S2222S5S2656Tess226SS285812. What is the through pu t (

13、bytes tran sferred per unit time) for the TCP connection? Explain how you calculated this value.13. Use the Time-Sequence-Graph(Stevens) plottingtool to view the sequeneephasenu mber versus time plot of segme nts being sent from the clie nt to the server. Can you identifywhere TCP s

14、 slowstartbegi ns and en ds, and where con gesti on avoida nee takes over? Comme nt on ways in which the measured data differs from the idealized behavior of TCP that we ve studied in the text。Answer:慢启动阶段即从HTTP POS报文段发出时开始但是无法判断什么时候慢启动结 束拥塞避免阶段开始。慢启动阶段和拥塞避免阶段的鉴定取决于发送方拥塞窗口的大 小。拥塞窗口的大小并不能从时间一序号图time-seque nce-gra ph直接获得。然而在一个发送方中未被确认的数据量即in flight数据量不会超过 CongWin拥塞窗口和最 小 值 即 。同时在第9题中看到in flight数据量是由拥塞窗口决定的所以通过发出而未被确认的数据量即in flight数据量我们可以估计拥塞窗口大小的下界。下表列出了部分in flight数据量从表中可以看出拥 塞窗口的下界=8192（因为in flight data从未超过8192）。但是从第10题即从时间一序号图得没有分组丢失不管是超时还是三个冗余ACK因此无法判断什么时候慢启动结束拥塞避免阶段开始。RcvWi