Question

You can refer chapter 2 and chapter 3 of Computer Networking: A Top-Down approach by Kurose and Ross for the following labs.

Please read the instructions below for submissions.

Upload the shared pcap file (Homework5.pacp) into wireshark.

1. HTTP

In this lab, we’ll explore several aspects of the HTTP protocol. Capture packets and filter for http protocol and answer the following questions. (Hint: Apply http filer)

1. What version of HTTP version(1.0 or 1.1) is client running and what is the version of HTTP is the server running?
2. What are the status code being returned from the server?
3. How many HTTP GET request messages were sent by the client?

2. DNS

In this lab, we take a closer look at the client side of the DNS, the protocol that translates Internet hostnames to IP addresses. (Hint: Apply dns filter)

1. Locate the DNS query/response messages. How are they sent over, is it UDP or TCP?
2. What domain is being accessed?
3. What is the destination port for the DNS Query message? What is the source port of DNS response message?

Answer 1

1.HTTP

Step 1: Start browser and Wireshark on correct interface

Step 2: Only capture http by using the filter

Step 3: Enter the following URL http://gaia.cs.umass.edu/wireshark-labs/HTTP-wireshark-file1.html

Step 4: Stop the capture

$//img.homeworklib.com/questions/ff43e780-f950-11eb-a9b3-3fdf84be6128.png?x-oss-process=image/resize,w_560$

1. Is your browser running HTTP version 1.0 or 1.1? What version of HTTP is the server running?
   My browser is running http version 1.1The server is also running http version 1.1
2. What is the status code returned from the server to your browser?
   The status code returned was 200 OK

Microsoft: \Device NPF_(483C83F4-DCBA-4863-8523-3C4E18 Eile Edit View So Capture nalyze Statistics Telephony Iools Internals Help 딜 eUK 쉽을|4や净曳下4 [E1国 Q a Q VN Rev 47350 from /trunk-1.8 a団! % @ Filter: http Expression.... Clear Apply Save Time Source Destination Protocol Length Info 27 20:04:59.049818000 10. 36.40.181 128.119.245.12 shark-file1.html HTTP/1.1 HTTP 28 20:04:59.07414 5000 30 20:04:59.330315000 20:04:59. 350880000 128.119. 245.12 10. 36.40.181 128.119. 245.12 10. 36.40.181 128.119.245.12 457 HTTP/1.1 200 OK (text/html) HTTP HTTP 10. 36.40.1 532 HTTP/1.1 404 Not Found(text/html) Hypertext Transfer Protocol GET /wireshark-labs/HTTP-wireshark-filel.htm1 HTTP/1.1 Host: gaia. cs. umass. edurn connection: keep-aliver n Accept: text/htm1,application/xhtml+xm1,application/xml:q-0.9,*q-0.8 rn user-Agent: Mozilla/5.0 (windows NT 6.1; wow64) Applewebki t/537 .22 (KHTML, like Gecko) Chrome/2 5.0.1364. 97 safari /537. 22\r\n Accept-Encoding: gzip,deflate,sdchrn Accept-Language: en-us,en:q-0.8 r n Accept-charset: IS0-8859-1,utf-8:q-0.7,:q-0.3 r n If-None-Mtch "8734d-80-479b7f40rn If-Modified-since: wed, 27 Feb 2013 00:59:01 GMITr n rtn 0000 00 1e f7 4c 61 3f CCc af 78 0a de 6b 08 00 45 00 0010 02 21 61 30 40 00 80 06 ef 49 0a 24 28 b5 80 77 0020 f5 Oc d6 60 00 50 cl 81 58 cb do 06 7b 11 50 18 0030 44 70 ca 7e 00 00 47 45 54 20 2f 77 69 72 65 73 Dp..GE T /wires 0040 68 61 72 6b 2d 6c 61 62 73 2f 48 54 54 50 2d 77hark-1ab s/HTTP-W La?.. x..k..E 切 File:"C:\Users\Max App Datal LocalTempl Packets 37 Displayed 4 Marked: 0 Dropped: 0 Profile: Default

• 3. How many HTTP GET request messages did your browser send?
  • My browser only sent 1 HTTP GET request to the server.

Capturing from Microsoft: \Device File Edit Yew Go Capture Analyze Statistics Telephony lools Internals Help 딜鹹胤侧鹹 酃 x 쉽 을 | 〒1 | |国|Qaam 碳団 鬊 @ NPF 1483C83F4-DCBA-4863-8523-3C4E1BO3DO6F) Wireshark 1.8.5 (SVN Rev 47350 from /trunk-1 Filter: http Expression.... Clear Apply Save Time No. Source Destination 10. 36.40 239.255. 255.250SSDP 528 NOTIFY HTTP/1.1 222 21:13:58. 590670000 10. 36.40.181 128.119. 245.12 473 GET /wireshark-1abs/HTTP-wireshark-file3. html HTTP/1.1 233 21:13:59.117254000 10. 36.40.181 HTTP 556 NOTIFY HTTP/1.1 584 NOTIFY HTTP/1.1 384 GET/favicon. ico HTTP/1.1 532 HTTP/1.1 404 Not Found (text/html) 542 NOTIFY HTTP/1.1 242 21:13:59.190558000 243 21:13:59.190758000 245 21:13:59.443994000 10. 36.40.181 fe80::4195:59f3:544 ff02::c 10.36.40.181 239. 255.255. 250 SSDP SSDP 128.119.245.12 HTTP 246 21:13:59.462702000 247 21:13:59.467414000 128.119. 245.12 10. 36.40.181 10.36.40.181 HTTP 239.255. 255.250 SSDP n Frame 241: 452 bytes on wire (3616 bits),452 bytes captured (3616 bits) on interface o Ethernet II, Src: Ccisco 4c:61:3f (00:1e:f7:4c:61:3f), Dst HonHaipr_0a:de:6b (cc:af:78:0a:de:6b) 困Internet Protocol version 4, Src: 128.119.24 5.12 (128.119.24 5.12), Dst: 10.36.40.181 (10.36.40.181) 困Transmission control Protocol, Src Port: http (80), Dst Port: 55990 (55990), seq: 4381' Ack: 420' Len: 398 [5 Reassembled TCP Segments (4778 bytes) : #234 (1423), #237(1460), #239(1460), #2 35(37), #241(398)] Hypertext Transfer Protoco1 HTTP/1.1 200 oKr n Date: Wed, 27 Feb 2013 02:14:00 GMTn Server: Apache/2.2.3 (Centos) rn Last-Modified Wed, 27 Feb 2013 02:13:01 GMT n ETag: "d6c97-1194-50408540"rn Accept-Ranges: bytesr n Content-Type: text/html; charset-UTF-81rn 困Content-Length: 4500\r\n Connection: Keep-Aliverin Age: orin rin 3:01 GMT rin Oa de 66 00 1e La?..E 4c 61 3f 08 00 45 0 01 b6 5f cd 00 00 3a 06 77 18 80 77 f5 0c 0a 24 28 b5 00 50 da b6 70 e7 fd 49 a7 2b b3 a2 50 18 f ff 16 ab 00 00 70 3e 3c 2f 70 3e 3c 70 3e 54 68 65 20 65 6e 75 6d 65 72 61 74 69 6f 6e 20 6 6e 20 74 68 65 20 43 6f 6e 73 74 69 74 75 74 6 0010 0020 0030 0040 0050 p> </pxp> e enume ration the co nstituti Frame (452 bytes) Reassembled TCP (4778 bytes) O Frame (frame), 452 bytes Profile: Default Packets: 336 Displayed: 40 Marked:0

---------------------------------------------------------------------------------------------------------------------------------------------------------------------

2.DNS

----------

STEPS: Part 1: IPconfig

Step 1: Use ipconfig to empty the DNS cache in your host.

Step 2: Open your browser and empty your browser cache. (With Internet Explorer, go to Tools menu and select Internet Options; then in the General tab select Delete Files.)

Step 3: Open Wireshark and enter “ip.addr == your_IP_address” into the filter, where you obtain your_IP_address with ipconfig. This filter removes all packets that neither originate nor are destined to your host.

Step 4: Start packet capture in Wireshark.

Step 5: With your browser, visit the Web page: http://www.ietf.org

Step 6: Stop packet capture.

Microsoft: VDevice NPF_(483C83F4-DCBA-4863-8523-3C4E1803D06F) Wireshark 18.5 (SVN Rev 47350 from /trunk-1.8)] Eile Edit View Go Capture nalyze Statistics Telephony Iools Internals Help 띌 @鹹 x순을|qや净わ〒2|E QaQ-a団记% @ Filter: ip.addr10.36.41.43 Expression.. Clear Apply Save Time Source Destination Protocol Length Info 039000 173 9 13:51:23.477 .194.43.37 10.36.41.43 10. 36.41.43 173.194.43.37 173.194.43 10.36.41.43 TLSv1.1 115 Application Data TLSv1.1 95 Application Data 10 13:51:23.477132000 173.194.43. 37 54 62364 > https [ACK] Seq-2 Ack-103 win-16478 Len-0 62364 >https [FIN, ACK] Seq-2 Ack-103 win-16478 Le https> 62364 [FIN, ACK] seq-103 Ack 2 win-63784L 54 62364 > https [ACK] Seq 3 Ack-104 win-16478 Len-0 54 https 62364 [ACK] Seq-104 Ack 3 win 63784 Len-0 72 Standard query 0x9f7dA www.ietf.org 473 Standard query response 0x9f7d A 64.170.98. 30 88 Standard query 0x6028A tunnel.cfw.trustedsource.org 104 Standard query response 0x6028 A 8.21.161.7 62 62382 > https [SYN] Seq=0 win-8192 Len-O MS5-1460 SACK-PERM-1 62 https 62382 [SYN, ACK] Seq-0 Ack-1 win-5840 Len-0 M5S-14 54 62382 > https [ACK] Seq-1 Ack-1 win-17520 Len-0 149 client Hello 11 13:51:23.477211000 10.36.41.43 TCP 2 13:51:23.477 3 13:51:23.477657000 10.36.41.43 73.194.43 TCP 14 13:51:23.477694000 10. 36.41.43 TCP 15 13:51:23.491240000 16 13:51:27.041610000 173.194.43.37 10. 36.41.43 10. 36.41.43 10.40.4.44 17 13:51:27.160178000 10.40.4.44 10.36.41.43 DNS 18 13:51:27.166692000 10. 36.41.43 10.40.4.44 DNS 19 13:51:27.167744000 10.40.4.44 10.36.41.43 8.21.161.7 DNS 20 13:51:27.180583000 1 13:51:27.258985000 10. 36.41.43 8.21.16 22 13:51:27.259111000 10. 36.41.43 8. 21.161.7 TCP 5947200010 23 13:51:27.2 . 36.41.43 8.21.161.7 10. 36.41.43 TLSv1 54 https 62382 [ACK] Seq-1 Ack-96 win-5840 Len-o 24 13:51:27. 336962000 8.21.161.7 TCP Frame 1: 55 bytes on wire (440 bits), 55 bytes captured (440 bits) on interface o t Ethernet 11 , SrC: HOnHaǐPr_0a : de : 6b (cc :af :78 :0a : de : 6b), Dst: Cisco.,4c :61 :3f (00:1e:f7:4c:61:3f) 困Internet Protocol version 4, Src: 10.36.41.43 (10.36.41.43), Dst: 74.125.131.147 (74.125.131.147) n Transmission Control Protocol, Src Port: 62379 (62379), Dst Port: https (443), seq: 1, Ack: 1, Len: 1 Secure sockets Layer La?.. x..k..E 0000 00 1e f7 4c 61 3f CCc af 78 0a de 6b 08 00 45 00 10 00 29 47 77 40 00 80 06 bl f8 0a 24 29 2b 4a 7d. )GwC. . 20 83 93 f3 ab 01 bb 61 fa dd 7b 25 83 f6 9b 50 10 0030 3f f7 1d 81 00 00 00 File: "CAUsers Max'AppData Loca Temptw... Packets: 233 Displayed: 231 Marked: 0 Dropped: 0 Profile: Default

1. Locate the DNS query and response messages. Are then sent over UDP or TCP?

               The DNS query and response messages are sent over UDP.

Microsoft \Device NPF (483C83F4-DCBA-4863-8523-3C4E1B03D06F) [Wireshark 1.8.5 (SVN Rev 47350 from /trunk-1.8) File Edit Yew Go Capture Analyze Statistics Telephony 1001s Internals 비elp 쉽 을 і 4や净わ了1|EE! a a Q 딜鹹幽 a ® ede % @ Filter: ip.addr10.36.41.43 Expression.. Clear Apply Save No. Source Destination Protocol Length Info 6 13:51:10.148188000 fe80::8000:f227:bec fe80: :ffff:ffff:fff ICMPv6 151 Router Advertisement 913:51:23.477039000 173.194.43. 37 10 13:51:23.477132000 173.194.43.37 11 13:51:23.477211000 10. 36.41.43 12 13:51:23.477 13 13:51:23.477657000 10. 36.41.43 10. 36.41.43 173.194.43.37 TLSv1.1 115 Application Data TLSv1.1 95 Application Data 54 62364 https [ACK] Seq-2 Ack-103 win-16478 Len-0 TCP 73.194.43 10. 36.41.43 14 13:51:23.477694000 173.194.43.37 54 62364 > https [ACK] Seq-3 Ack-104 win-16478 Len-o TCP 16 13:51:27.041610000 10. 36.41.43 10.40.4.44 DNS 72 Standard query 0x9f7d A www.ietf.org 473 Standard query response 0x9f7d A 64.170.98. 30 17 13: 51:27.160178000 10.40.4.44 10. 36.41.43 DNS 166692000 10. 36.41.43 tandard query ox unne l. crw.trustedsource.org 19 13:51:27.167744000 20 13:51:27. 10.40.4.44 180583000 10.36.41.43 10. 36.41.43 104 Standard query response 0x6028 A 8.21.161.7 62 62382 > https [SYN] Seq=0 win-8192 Len-O MSS-1460 SACK-PERN-1 DNS 8.21.161.7 1 13:51:27.258985000 8.21.1 22 13:51:27.259111000 10. 36.41.43 23 13:51:27.259472000 10. 36.41.43 8. 21.161.7 8. 21.161.7 54 62382 > https [ACK] Seq-1 Ack-1 win-17520 Len-o 149 Client Hello TCP TLSV1 Frame 16: 72 bytes on wire (576 bits), 72 bytes captured (576 bits) on interface o 困Ethernet II, SrC : HonHai Pr_0a: de : 6b (cc : af : 78 : 0a: de : 6b), Dst : Cisco-4c : 61 : 3f (00: 1e: f7: 4c : 61: 3f) (10.40.4.44) user Datagram Protocol, Src Port: 50133 (50133), ost Port: domain (53) Source port: 50133 C50133) Destination port: domain (53) Length: 38 a Checksum 0x3832 validation disabled] oomain Name System (query) 0000 00 1e f7 4C 61 3f cc af 78 oa de 6b 08 00 45 00 0010 00 3a 47 7d 00 00 80 11 bi 93 0a 24 29 2b 0a 28 0020 04 2c c3 d5 00 35 00 26 38 32 9f 7d 01 00 00 01 0030 00 00 00 00 00 00 03 77 77 77 04 69 65 74 66 03 0040 6f 72 67 00 00 01 00 01 5.& 82 w ww. ietf OザFile: "C:\UsersManAppDataLocalTempw | Packets: 233 Displayed: 231 Marked: 0 Dropped: 0 Profile: Default

2. What is the destination port for the DNS query message? What is the source port of DNS response message?

                     The destination port is 53

        The source port is 50133

Microsoft \Device NPF (483C83F4-DCBA-4863-8523-3C4E1B03D06F) [Wireshark 1.8.5 (SVN Rev 47350 from /trunk-1.8) Eile Edit View Go Capte nalyze Statistics Telephony Iools Internals Help Filter: ip.addr10.36.41.43 Expression.. Clear Apply Save No. Source Destination Protocol Length Info 6 13:51:10.148188000 fe80::8000:f227:bec fe80: :ffff:ffff:fff ICMPv6 151 Router Advertisement 913:51:23.477039000 173.194.43. 37 10 13:51:23.477132000 173.194.43.37 11 13:51:23.477211000 10. 36.41.43 12 13:51:23.477 13 13:51:23.477657000 10. 36.41.43 10. 36.41.43 173.194.43.37 TLSv1.1 115 Application Data TLSv1.1 95 Application Data 54 62364 https [ACK] Seq-2 Ack-103 win-16478 Len-0 TCP 73.194.43 10. 36.41.43 173.194.43. 37 36.41.43 173.194.43. 37 10. 36.41.43 10.40.4.44 10. 36.41.43 10.40.4.44 10. 36.41.43 8.21.161.7 TCP https〉 62364 [FIN, ACK] Seq=103 Ack-2 win-63784 Le 54 62364 > https [ACK] Seq-3 Ack-104 win-16478 Len-o 54 https 62364 [ACK] Seq-104 Ack-3 Win-63784 Len-0 72 Standard query 0x9f7d A www.ietf.org 473 Standard query response 0x9f7d A 64.170.98.30 88 Standard query 0x6028 A tunnel.cfw.trustedsource.org 104 Standard query response 0x6028 A 8.21.161.7 62 62382 > https [SYN] Seq=0 win-8192 Len-O MSS-1460 SACK-PERN-1 14 13:51:23.477694000 15 13:51:23.491240000 TCP TCP 16 13:51:27.041610000 10. 36.41.43 DNS 17 13:51:27.160178000 18 13:51:27.166692000 19 13:51:27.167744000 20 13:51:27. 10.40.4.44 10. 36.41.43 10.40.4.44 180583000 10.36.41.43 DNS DNS DNS 1 13:51:27.258985000 8.21.1 22 13:51:27.259111000 10. 36.41.43 23 13:51:27.259472000 10. 3 8. 21.161.7 8. 21.161.7 54 62382 > https [ACK] Seq-1 Ack-1 win-17520 Len-o 149 Client Hello TCP 6.41.43 TLSV1 Frame 16: 72 bytes on wire (576 bits), 72 bytes captured (576 bits) on interface o 困Ethernet II, SrC : HonHai Pr_0a: de : 6b (cc : af : 78 : 0a: de : 6b), Dst : Cisco-4c : 61 : 3f (00: 1e: f7: 4c : 61: 3f) ser Datagram Protocol, Src Port: 50133 (50133), Dst Port: Source port: 50133 C50133) Destination n (53 domain (53) Checksum: 0x3832 [validation disabled] Domain Name System (query) 0000 00 1e f7 4C 61 3f cc af 78 oa de 6b 08 00 45 00 0010 00 3a 47 7d 00 00 80 11 bi 93 0a 24 29 2b 0a 28 0020 04 2c c3 d5 00 35 00 26 38 32 9f 7d 01 00 00 01 0030 00 00 00 00 00 00 03 77 77 77 04 69 65 74 66 03 0040 6f 72 67 00 00 01 00 01 La?.. x..k..E 5.& 82 w ww. ietf O File: "UsersMax AppDatalLocal Tempw... Packets: 233 Displeyed: 231 Marked: 0 Dropped: 0 Profile: Default