ITKP104 Data Networks - Analysator work (1 ECTS)

Start capture of network traffic. Open a new browser (tab) and go to address http://users.jyu.fi/~arjuvi/opetus/itkp104/Labra1.html

(a) How many HTTP GET request -messages were sent?

(b) To what addresses were the messages sent to?

(c) Can you tell if the images were loaded in parallel or not?

(d) Return packet capture. Filter out all non-related traffic.
Simple HTTP authentication. Start capture of network traffic. Open a new browser (tab) and go to address http://users.jyu.fi/~arjuvi/opetus/itkp104/salasana/Salasana.php and provide username and password (can be anything as long as they are not your real username or password).

(a) What is the status code used by the server to inform that username and passwordd are required?

(b) What HTTP header -field is used by the browser to transfer the username and password? What coding is used?

(c) Return packet capture. Filter out all non-related traffic.

(d) What other authentication methods can be used with HTTP?
Make a Telnet connection to server example.com, example.org or example.net using HTTP 1.1 protocol Return packet capture. Filter out all non-related traffic. How many packets are sent?

Use the TCP client from Tools

Send a HTTP 1.1 GET message as in the previous task, to some server (example.com, example.org or example.net), but now in two or more packets. Return packet capture. Filter out all non-related traffic.
Your task is to get the server to respond with the code: 304 (Not modified). You can find the required HTTP header e.g from Excersise 1 task 2. Return packet capture. Filter out all non-related traffic.
HTTP persistent and non-persistent HTTP connections.

(a) First get the objects testi.html and testi2.html from users.jyu.fi/~arjuvi/opetus/itkp104/ using non-persistent HTTP. Return packet capture. Filter out all non-related traffic.

(b) Next get the above objects using persistent HTTP (without pipelining). Return packet capture. Filter out all non-related traffic.

(c) Explain the difference above.

(d) Finally get the objects using HTTP Persistent with pipelining method Return packet capture. Filter out all non-related traffic.

Use TCP Client from Tools

Open the TCP server found from Tools and start it as an SMTP server Make a connection to the the above server and send email to yourself. Do at least one of the below tasks (a) - (c)

(a) Copy the communication between the client and the server and return it.

(b) Capture the traffic generated with RawCap or tcpdump. Return packet capture. Filter out all non-related traffic.

(c) Make SSL secured connection to smtp.gmail.com server (port 465) and send email to yourself. Return packet capture. Filter out all non-related traffic. ALSO remove the packets that contain (your) Base64 encoded username and password.

Use TCP Client from Tools

For testing FTP protocol you need 2 simultaneous TCP connections.

(a) First use a browser to connect to some FTP server (e.g ftp.mozilla.org, ftp.fi.debian.org, ftp.cac.washington.edu) Return packet capture (of the signaling connection). Filter out all non-related traffic.
(b) Next make a TCP connection to the same FTP server (port 21) and use FTP protocol as in the example below Return packet capture (of both the signaling and data connection). Filter out all non-related traffic.

Use a browser and go to http://gaia.cs.umass.edu/ethereal-labs/alice.txt save the file to your computer. Next go to http://gaia.cs.umass.edu/ethereal-labs/TCP-ethereal-file1.html and use Browse -button to find the file you just downloaded. Now start packet capture and after that click ``Upload Alice.txt file''. When the upload is complete you will be notified. Stop packet capture. Filter out all non-related traffic.

(a) First is TCP three-way handshake. What are the real sequence and acknowledge numbers in those packets?

(b) What is the MSS value and receive windows size?

(c) What HTTP method is found on the packet right after the three-way handshake?

(d) Click the packet and then Analyze -> Follow TCP Stream. Describe the behaviour you can observe from the DATA packets and the ACKs (Statistics -> Flow Graph... sekä Statistics -> TCP Stream Graph -> Time-Sequence Graph (Stevens)). Return packet capture. Filter out all non-related traffic.

TCP flow graph example

|Time     | 130.234.169.82                        |
|         |                   | 128.119.245.12    |                   
|15,233   |         SYN       |                   |Seq = 0
|         |(61622)  ------------------>  (80)     |
|15,357   |         SYN, ACK  |                   |Seq = 0 Ack = 1
|         |(61622)  <------------------  (80)     |
|15,357   |         ACK       |                   |Seq = 1 Ack = 1
|         |(61622)  ------------------>  (80)     |
|15,357   |         PSH, ACK - Len: 701           |Seq = 1 Ack = 1
|         |(61622)  ------------------>  (80)     |
|15,358   |         ACK - Len: 1460               |Seq = 702 Ack = 1
|         |(61622)  ------------------>  (80)     |
|15,480   |         ACK       |                   |Seq = 1 Ack = 702
|         |(61622)  <------------------  (80)     |
|15,480   |         ACK - Len: 1460               |Seq = 2162 Ack = 1
|         |(61622)  ------------------>  (80)     |
|15,482   |         ACK       |                   |Seq = 1 Ack = 2162
|         |(61622)  <------------------  (80)     |
|15,482   |         ACK - Len: 1460               |Seq = 3622 Ack = 1
|         |(61622)  ------------------>  (80)     |
|15,482   |         ACK - Len: 1460               |Seq = 5082 Ack = 1
|         |(61622)  ------------------>  (80)     |
|15,605   |         ACK       |                   |Seq = 1 Ack = 3622
|         |(61622)  <------------------  (80)     |
|15,605   |         ACK - Len: 1460               |Seq = 6542 Ack = 1
|         |(61622)  ------------------>  (80)     |
|15,605   |         ACK - Len: 1460               |Seq = 8002 Ack = 1
|         |(61622)  ------------------>  (80)     |
|15,606   |         ACK       |                   |Seq = 1 Ack = 5082
|         |(61622)  <------------------  (80)     |
|15,606   |         ACK       |                   |Seq = 1 Ack = 6542
|         |(61622)  <------------------  (80)     |
|15,606   |         ACK - Len: 1460               |Seq = 9462 Ack = 1
|         |(61622)  ------------------>  (80)     |
|15,606   |         ACK - Len: 1460               |Seq = 10922 Ack = 1
|         |(61622)  ------------------>  (80)     |
|15,606   |         ACK - Len: 1460               |Seq = 12382 Ack = 1
|         |(61622)  ------------------>  (80)     |
|15,606   |         ACK - Len: 1460               |Seq = 13842 Ack = 1
|         |(61622)  ------------------>  (80)     |
|15,729   |         ACK       |                   |Seq = 1 Ack = 8002
|         |(61622)  <------------------  (80)     |

Time-Sequence Graph (Stevens) example

Use ping program from command prompt to test the delay to example.com, example.org or example.net or to a server of your choice.

(a) Capture the traffic. What protocol and what messages are used by ping? Return packet capture. Filter out all non-related traffic.

(b) Find the MTU (by disabling datagram fragmentation).

(c) Enable fragmentationja and choose a big number for ping packet data and test ping on the server. How many parts was the ping message fragmented to?
Use tracert on command prompt, to some server (e.g. tracert www.google.fi). Capture traffic and answer to the following (if you are using Linux or Mac then the program is traceroute and you can even specify what protocol is used)

(a) What is the protocol used on the packets that traceroute sends?

(b) Depending on the protocol used you should be able to answer one of these questions: What is the message used by the above protocol? Or what is the port used?

(c) What protocol is used by the routers to respond? What is the message used?

(d) Return packet capture. Filter out all non-related traffic.

This task requires that your computer uses DHCP to obtain an IP address (i.e. IP is not set manually).

(a) Release and renew your IP address using DHCP. What DHCP messages can you capture?

(b) What are the IP and MAC addresses used as destination on the packets it sends?

(c) What protocol is used by DHCP on the transport layer?

(d) What are the source and destination port numbers on the packets send by your computer
Open a browser and clear its cache. Clear the DNS cache (ipconfig /flushdns). Go to address http://www.ietf.org. Find the DNS query and DNS response messages.

(a) What protocol is used on the transport layer?

(b) What is the source port number of the DNS query message? What is the destination port number of the DNS response message?

(c) The www page contains images. Are other DNS queries made for the images?

(d) Return packet capture. Filter out all non-related traffic.
ARP messages. See the routing table of your computer (netstat -rn)and find the default router. Then see the ARP table (arp -a) and locate the row containing the router address. Remove it from the ARP table and generate any network traffic and capture it.

(a) What ARP messages do you find?

(b) Return packet capture. Filter out all non-related traffic.

ITKP104 Data Networks - Analysator work (1 ECTS)

Network analyzers

Tasks