计算机网络实验：Ethernet-and-ARP

Lab7EthernetandARP

1.CapturingandanalyzingEthernetframes

STEPS

•First,makesureyourbrowser’scacheisempty.(TodothisunderNetscape7.0,selectEdit->Preferences->Advanced->Cacheandclearthememoryanddiskcache.ForInternetExplorer,selectTools->InternetOptions->DeleteFiles.ForFirefoxselectTools->ClearPrivateData.

•StartuptheWiresharkpacketsniffer

•EnterthefollowingURLintoyourbrowser/wireshark-labs/HTTP-ethereal-lab-file3.htmlYourbrowsershoulddisplaytheratherlengthyUSBillofRights.

•StopWiresharkpacketcapture.First,findthepacketnumbers(theleftmostcolumnintheupperWiresharkwindow)oftheHTTPGETmessagethatwassentfromyourcomputerto,aswellasthebeginningoftheHTTPresponsemessagesenttoyourcomputerby.Youshouldseeascreenthatlookssomethinglikethis(wherepacket4inthescreenshotbelowcontainstheHTTPGETmessage)

•SincethislabisaboutEthernetandARP,we’renotinterestedinIPorhigherlayerprotocols.Solet’schangeWireshark’s“listingofcapturedpackets”windowsothatitshowsinformationonlyaboutprotocolsbelowIP.TohaveWiresharkdothis,selectAnalyze->EnabledProtocols.ThenunchecktheIPboxandselectOK.

QUESTIONS

Whatisthe48-bitEthernetaddressofyourcomputer?

The48-bitEthernetaddressofyourcomputeris3c:97:0e:ff:69:02

Whatisthe48-bitdestinationaddressintheEthernetframe?IsthistheEthernetaddressof?(Hint:theanswerisno).WhatdevicehasthisasitsEthernetaddress?[Note:thisisanimportantquestion,andonethatstudentssometimesgetwrong.Re-readpages468-469inthetextandmakesureyouunderstandtheanswerhere.]

The48-bitdestinationaddressintheEthernetframeis38:22:d6:e6:0e:0d.Thisisn’ttheEthernetaddressof.ItistheEthernetaddressofmydefaultgateway.Thatistosay,it’stheaddressofmyrouter,whichisthelinkusedtogetoffthesubnet.

Givethehexadecimalvalueforthetwo-byteFrametypefield.Whatdothebit(s)whosevalueis1meanwithintheflagfield?

Thehexadecimalvalueforthetwo-byteFrametypefieldis0x0800.

Thebit(s)whosevalueis1withintheflagfieldmeanthefragmenthasnotbeenfragmented.

eachcolumnvalue?

TheaddressofInternetcolumncontainstheIPaddress.ThephysicaladdresscolumncontainstheMACaddress.Thetypecolumntellsustheinformationabouttype:dynamicorstatic.

STEPS

•ClearyourARPcache,asdescribedabove.

•Next,makesureyourbrowser’scacheisempty.(TodothisunderNetscape7.0,selectEdit->Preferences->Advanced->Cacheandclearthememoryanddiskcache.ForInternetExplorer,selectTools->InternetOptions->DeleteFiles.)

•StartuptheWiresharkpacketsniffer

•EnterthefollowingURLintoyourbrowser/wireshark-labs/HTTP-wireshark-lab-file3.htmlYourbrowsershouldagaindisplaytheratherlengthyUSBillofRights.

•StopWiresharkpacketcapture.Again,we’renotinterestedinIPorhigher-layerprotocols,sochangeWireshark’s“listingofcapturedpackets”windowsothatitshowsinformationonlyaboutprotocolsbelowIP.TohaveWiresharkdothis,selectAnalyze->EnabledProtocols.ThenunchecktheIPboxandselectOK.YoushouldnowseeanWiresharkwindowthatlookslike:

QUESTIONS

(Thefollowinganswersarebasedontheethernet-ethereal-trace-1tracefile)

12.WhatarethehexadecimalvaluesforthesourceanddestinationaddressesintheEthernetframecontainingtheARPrequestmessage?

ThehexadecimalvaluesforthesourceaddressesintheEthernetframeis00:d0:59:a9:3d:68.ThehexadecimalvaluesforthedestinationaddressesintheEthernetframeisff:ff:ff:ff:ff:ff.

13.Givethehexadecimalvalueforthetwo-byteEthernetFrametypefield.Whatdothebit(s)whosevalueis1meanwithintheflagfield?

Thehexadecimalvalueforthetwo-byteEthernetFrametypefieldis0x0806.

Thereisnoflagfield.

14.DownloadtheARPspecificationfrom/innotes/std/std37.txt.Areadable,detaileddiscussionofARPisalsoat

http://www.erg.abdn.ac.uk/users/gorry/course/inets/arp.html

.

HowmanybytesfromtheverybeginningoftheEthernetframedoestheARPopcodefieldbegin?

Thereare14bytesofEthernetframeheader.IntheARPdata,beforetheARPopcodefieldbegin,thereare6bytes.Sothereare20bytesbeforetheARPopcodefieldbegin.

WhatisthevalueoftheopcodefieldwithintheARP-payloadpartoftheEthernetframeinwhichanARPrequestismade?

ThevalueoftheopcodefieldwithintheARP-payloadpartoftheEthernetframeinwhichanARPrequestismadeis1.

DoestheARPmessagecontaintheIPaddressofthesender?

Yes,itcontains.Inhere,theIPaddressofthesenderis05.

WhereintheARPrequestdoesthe“question”appear–theEthernetaddressofthemachinewhosecorrespondingIPaddressisbeingqueried?

Thefield“TargetMACaddress”issetto00:00:00:00:00:00toquestionthemachine’sEthernetaddresswhosecorrespondingIPaddress.

15.NowfindtheARPreplythatwassentinresponsetotheARPrequest.

HowmanybytesfromtheverybeginningoftheEthernetframedoestheARPopcodefieldbegin?

Thereare14bytesofEthernetframeheader.IntheARPdata,beforetheARPopcodefieldbegin,thereare6bytes.Sothereare20bytesbeforetheARPopcodefieldbegin.

WhatisthevalueoftheopcodefieldwithintheARP-payloadpartoftheEthernetframeinwhichanARPresponseismade?

ThevalueoftheopcodefieldwithintheARP-payloadpartoftheEthernetframeinwhichanARPresponseismadeis2

WhereintheARPmessagedoesthe“answer”totheearlierARPrequestappear–theIPaddressofthemachinehavingtheEthernetaddresswhosecorrespondingIPaddressisbeingqueried?

“SenderMACaddress”istheanswertotheearlierARPrequest.Inhere,itcontaintheMACaddressof,whichis00:06:25:da:af:73

16.WhatarethehexadecimalvaluesforthesourceanddestinationaddressesintheEthernetframecontainingtheARPreplymessage?

ThehexadecimalvaluesforthesourceaddressesintheEthernetframecontainingtheARPreplymessageis00:06:25:da:af:73.

ThehexadecimalvaluesforthedestinationaddressesintheEthernetframecontainingtheARPreplymessageis00:d0:59:a9:3d;68.

17.Opentheethernet-ethereal-trace-1tracefilein/wireshark-labs/wireshark-traces.zip.ThefirstandsecondARPpacketsinthistracecorrespondtoanARPrequestsentbythecomputerrunningWireshark,andtheARPreplysenttothecomputerrunningWiresharkbythecomputerwiththeARP-requestedEthernetaddress.Butthereisyetanothercomputeronthisnetwork,asindiatedbypacket6–anotherARPrequest.WhyistherenoARPreply(sentinresponsetotheARPrequestinpacket6)inthepackettrace?

ThisabroadcastARPpacketsentby04.Soeveryhostinthesamesubnetwillreceivethepacket.ButtheARPistotryfindtheMACaddressof17.SoonlythehostwhichhavetheIPaddressof17willreply.Now“my”host’sIPaddressis05.So“my”hostwon’treply.And“my”hostdidn’treceivethereplypacket.SothereisnoARPreply(sentinresponsetotheARPrequestinpacket6)inthepackettrace.

ExtraCredit

EX-1.Thearpcommand:arp-sInetAddrEtherAddrallowsyoutomanuallyaddanentrytotheARPcachethatresolvestheIPaddressInetAddrtothephysicaladdressEtherAddr.Whatwouldhappenif,whenyoumanuallyaddedanentry,youenteredthecorrectIPaddress,butthewro