陜師大計(jì)算機(jī)網(wǎng)絡(luò)試驗(yàn)6wireshark資料

1、陜 師 大 計(jì) 算 機(jī) 網(wǎng) 絡(luò) 實(shí)驗(yàn) 6 wi r e s ha r k精品文檔計(jì)算機(jī)網(wǎng)絡(luò) 實(shí)驗(yàn)報(bào)告利用 WireShark 分析 IP 協(xié)議計(jì)科一班 41112009 熊思平一、實(shí)驗(yàn)?zāi)康?. 利用 wireshark 分析 ip 協(xié)議，學(xué)習(xí)了解 ip 數(shù)據(jù)包。2. 學(xué)習(xí) ip 報(bào)文段的各領(lǐng)域。、實(shí)驗(yàn)器材1. 接入 Internet 的計(jì)算機(jī)主機(jī)；2. 抓包工具 wireshark 和截圖工具 snagit。三、實(shí)驗(yàn)內(nèi)容1. Select the first ICMP Echo Request message sent by your computer, and expandthe Inter

2、net Protocol part of the packet in the packet details window. What is theIP address of your computer?實(shí)驗(yàn)結(jié)果如下：收集于網(wǎng)絡(luò)，如有侵權(quán)請(qǐng)聯(lián)系管理員刪除精品文檔2. Within the IP packet header, what is the value in the upper layer protocol field? 答：the upper layer protocol field is 13. How many bytes are in the IP header? How many

3、 bytes are in the payload of theIP datagram ? Explain how you determined the number of payload bytes.答： 56-20=36就是有效載荷的長(zhǎng)度，即此 IP數(shù)據(jù)報(bào)的有效載荷為 36字節(jié) 實(shí)驗(yàn)結(jié)果如下：4. Has this IP datagram been fragmented? Explain how you determined whether ornot the datagram has been fragmented. 答：沒(méi)有分片，原因： flag 和 offset都為 0；收集于網(wǎng)絡(luò)，

4、如有侵權(quán)請(qǐng)聯(lián)系管理員刪除精品文檔實(shí)驗(yàn)結(jié)果如下如：5. Which fields in the IP datagram always change from one datagram to the next within this series of ICMP messages sent by your computer?答：分析結(jié)果之 TTL, 首部檢驗(yàn)和，標(biāo)識(shí)等一直在不斷地變化。6. Which fields stay constant? Which of the fields must stay constant? Which fieldsmust change? Why?答：分析可知：s

5、tay constant：版本號(hào) 首部長(zhǎng)度，服務(wù)類型，標(biāo)志，偏移，上層協(xié)議，目的和 源 IP 地址must stay constant ：必須保持不變的是：版本號(hào) 源和目的 IP 地址must change：標(biāo)識(shí)，首部檢驗(yàn)和7. Describe the pattern you see in the values in the Identification field of the IP Datagram答：the pattern is ：每一個(gè) IP 數(shù)據(jù)報(bào)頭部的標(biāo)識(shí)號(hào)域都不一樣，每次加一8. What is the value in the Identification field and

6、 the TTL field?收集于網(wǎng)絡(luò)，如有侵權(quán)請(qǐng)聯(lián)系管理員刪除精品文檔答： the value in the Identification field ：25603the TTL field ： 2549. Do these values remain unchanged for all of the ICMP TTL-exceeded replies sentto your computer by the nearest (first hop) router? Why? 答：每一個(gè)固定的路由器都有一個(gè)固定的 TTL 值，所以最近的那個(gè)路由器回復(fù) 的所有的 ICMP TTL-exceede

7、d 的TTL 的值都不會(huì)改變。11. Print out the first fragment of the fragmented IP datagram. What information inthe IP header indicates that the datagram been fragmented? What information inthe IP header indicates whether this is the first fragment versus a latter fragment? How long is this IP datagram?收集于網(wǎng)絡(luò)，如有侵權(quán)

8、請(qǐng)聯(lián)系管理員刪除精品文檔答：如截圖，數(shù)據(jù)報(bào)大小改為 2000 后，開(kāi)始分片12. Print out the second fragment of the fragmented IP datagram. What information inthe IP header indicates that this is not the first datagram fragment? Are the morefragments? How can you tell?答：由以上接入可知：這個(gè) IP數(shù)據(jù)報(bào)的長(zhǎng)度為 1500+520-20=2000bytes，從 這片 的片內(nèi)偏移量不為零可以看出這不是第一片

9、沒(méi)有更多的分片，因?yàn)檫@片的標(biāo)志 位已經(jīng)是 013. What fields change in the IP header between the first and second fragment?收集于網(wǎng)絡(luò)，如有侵權(quán)請(qǐng)聯(lián)系管理員刪除精品文檔答：改變的頭部字段有： Total Length ， Flags，F(xiàn)ragment offset ，Head checksum等14. How many fragments were created from the original datagram? 答：分析可知， 3 fragments were created from the original datagram 。15. What fields change in the IP header among the fra