計(jì)算機(jī)網(wǎng)絡(luò)實(shí)驗(yàn)報(bào)告

計(jì)算機(jī)網(wǎng)絡(luò)實(shí)驗(yàn)報(bào)告實(shí)一網(wǎng)數(shù)包議析姓：鑫學(xué)：20100740123班級(jí)物一一實(shí)驗(yàn)容掌握Ethereal的本使用方法利用Ethereal捕獲ICMP，TCP協(xié)議數(shù)據(jù)包，并對(duì)其進(jìn)行分析。掌握ICMP，TCP協(xié)數(shù)據(jù)包頭部各個(gè)數(shù)據(jù)位的意義。加深對(duì)I，協(xié)議原理的理解。二實(shí)驗(yàn)驟的使用安裝好，后開始捕獲數(shù)據(jù)包。選擇菜單上的Capture->Interfaces，如圖選擇好網(wǎng)卡點(diǎn)擊，圖在抓包點(diǎn)擊Stop然后主界面得到抓包況如圖：16

計(jì)算機(jī)網(wǎng)絡(luò)實(shí)驗(yàn)報(bào)告隨便選取一個(gè)包進(jìn)行分析即可。協(xié)議進(jìn)入dos界使用Ping命，程中會(huì)有ICMP包傳輸，這時(shí)打開Ethereal的抓包工具進(jìn)行抓包即可。如圖：Ethereal抓的包如圖分：隨便選擇一個(gè)數(shù)據(jù)包，然后中間的窗口如圖顯示分成四層，物理層，層網(wǎng)層協(xié)議。下面逐步分解：如下圖為物理層：顯示包的大小為74字捕字節(jié)包括到達(dá)時(shí)間，包序號(hào)，整個(gè)包包含的協(xié)議層為，有數(shù)據(jù)。如下圖為MAC層：主要信息有MAC層的源址目的地址，可以看出地址為6字節(jié)48位還說明了上層協(xié)議。26

計(jì)算機(jī)網(wǎng)絡(luò)實(shí)驗(yàn)報(bào)告如下圖為網(wǎng)絡(luò)層：分析可知，網(wǎng)絡(luò)層IP協(xié)層包括版本號(hào)IPV4部長度，服務(wù)類型，數(shù)據(jù)長度，標(biāo)識(shí)，標(biāo)志，壽命，還有上層協(xié)議為ICMP如下圖為協(xié)：首先是服務(wù)類型（請(qǐng)求包號(hào)，檢驗(yàn)和（正確識(shí)，序列號(hào)，數(shù)據(jù)。問回：1.WhatistheIPaddressofhost?WhatistheIPaddressofthedestinationhost?答：由網(wǎng)絡(luò)層分析可知本機(jī)IP為5目的主機(jī)IP為3如圖2.WhyisitthatanICMPpacketdoesnotsourceanddestinationportnumbers?答：它是一種差錯(cuò)和控制報(bào)文協(xié)議，不僅用于傳輸差錯(cuò)報(bào)文，還傳輸控制報(bào)文。它是控制協(xié)議，不需要端口號(hào)。3.Examineoftherequestbyyourhost.WhatICMPtypeandcodenumbers?WhatotherfieldsdoesthisICMPpackethave?Howmanybytesarechecksum,sequencenumberandidentifierfields?答：如圖類型為8,請(qǐng)求類型，code為0，還包括檢驗(yàn)和，序列號(hào)，數(shù)據(jù)包等，檢驗(yàn)和為0x445C，序列號(hào)為0x0500identifier為0x04004.Examinecorrespondingpingreplypacket.Whataretheandcodenumbers?WhatotherfieldsdoesthisICMPpackethave?Howmanybytesarethechecksum,sequenceandidentifierfields?36

計(jì)算機(jī)網(wǎng)絡(luò)實(shí)驗(yàn)報(bào)告答：如圖為0，回復(fù)類型code為0檢驗(yàn)和為0x4c5cidentifier為，列號(hào)為0x0500。5.Examinepacketinscreenshot.IsthisdifferentfromtheICMPpingquerypacketsinthefirsthalfofthislab?Ifhowso?答：不同如圖對(duì)比字分別為8和0.6.ExamineICMPerrorinyourscreenshot.IthasmorefieldsthantheICMPechopacket.Whatisincludedinthosefields?答：如圖為錯(cuò)誤包（請(qǐng)求超時(shí)）由圖可以看出多出了如下：都出了IP字段和（userDatagramprotocol）議字段。3.TCP協(xié)如圖為截取的TCP數(shù)據(jù)包：如圖為其中一個(gè)包的組成：46

計(jì)算機(jī)網(wǎng)絡(luò)實(shí)驗(yàn)報(bào)告主要有物理層，MAC層，網(wǎng)絡(luò)層IP協(xié)議傳輸層的協(xié)議。下載分析一下TCP協(xié)組成：如圖為TCP協(xié)議字段：主要有源端口號(hào)，目的端口號(hào)，序列號(hào)，頭部長度，標(biāo)志ACK，SYN等口小，檢驗(yàn)和。問回：1.WhatistheIPaddressandTCPportnumberusedbyyourclientcomputer(source)totransferfileto?WhatistheIPaddressandportnumberusedbytoreceivethefile.答：如圖可以看出我的IP和口分別為53647；的IP和口為280。2.WhatissequencenumberoftheTCPsegmentthatisusedtoinitiatetheTCPconnectiontheclientcomputerand?WhatisitinthesegmentthatidentifiesthesegmentasSYNsegment?答：如圖SYN=1。3.WhatisthesequencenumberoftheSYNACKsegmentsentbytotheclientcomputerinreplytotheWhatisthevaluetheACKnowledgementfieldintheSYNACKsegment?Howdiddeterminethatvalue?WhatisitinthesegmentthatidentifiesthesegmentasaSYNACKsegment?答：如圖56

計(jì)算機(jī)網(wǎng)絡(luò)實(shí)驗(yàn)報(bào)告SYN=ACK=1。ACKnowledgemen=1。4.WhatisthesequencenumberoftheTCPsegmentcontainingtheHTTPPOSTcommand?NotethatinordertofindthePOSTcommand,you’llneeddigintothepacketcontentfieldatthebottomEtherealwindow,lookingforasegmentwitha“POST”withinitsDATAfield.答：如圖可以看出sequencenumber=1，為theCommand時(shí)7.WhatistheminimumamountofavailablebufferspaceadvertisedatthereceivedfortheentireDoesthelackofreceiverbufferspaceeverthrottlethesender?答：最小如圖：沒有。三實(shí)驗(yàn)結(jié)心很完整的分析，開始是物理層層，網(wǎng)絡(luò)層，傳輸層，有