当前位置：文档库 › wireshark练习及答案lab-dhcp

wireshark练习及答案lab-dhcp

Lab Exercise – DHCP

Objective

To see how DHCP (Dynamic Host Configuration Protocol) works. The trace is here: https://www.wendangku.net/doc/ef11138099.html,/~kevin/com320/labs/wireshark/trace-dhcp.pcap Network Setup

Recall that DHCP is normally used to assign a computer its IP address, as well as other parameters such as the address of the local router. Your computer, the client, uses the DHCP protocol to communicate with a DHCP server on the local network. Other computers on the local network also interact with the DHCP server. In deployments, there are several variations. For example, the local agent may be a DHCP relay that relays messages between local computers and a remote DHCP server. Or the DHCP server may be replicated for reliability, so that there are two or more local DHCP servers. For our purposes, it is suf-ficient to think about a single DHCP server.

The complete DHCP exchange involves four types of packets: Discover, for your computer to locate the DHCP server; Offer, for the server to offer an IP address; Request, for your computer to ask for an of-fered address; and Ack, for the server to grant the address lease. However, when a computer is re-establishing its IP address on a network that it has previously used, it may perform a short exchange in-volving only two types of DHCP packets: Request, to ask for the same IP address as from the same server as was used before; and ACK for the server to grant the address lease.

Figure 1: DHCP message sequences

Your computer DHCP server

Short

exchange Complete exchange

Step 1: Capture a Trace

Proceed as follows to renew your IP address and gather a trace of DHCP traffic. Note, however, that the following procedure will not work in the unlikely case that your computer’s IP address is statically a s-signed. Alternatively, you may use a supplied trace. Take care not to perform this lab remotely, since when you tell your computer to shut down and restart its network interface you will lose connectivity!

https://www.wendangku.net/doc/ef11138099.html,unch Wireshark and start a capture with a filter of “(udp port 67) or (udp port 68)”.

There is no shorthand to indicate DHCP, so we filter traffic using the UDP ports reserved for

DHCP. (Note, in the display filter on main screen you can also type udp.port==67 II udp.port==68)

Figure 2: Setting up the capture options

2.When the capture is started, release and renew your IP address with the command given below.

This procedure may cause your computer to lose network connectivity temporarily, and depend-ing on the operating system it may disrupt network connections. To minimize the disruption,

close any programs that are using remote servers and enter the commands into a local window.

Windows: T ype the command “ipconfig /release” followed by “ipconfig

/renew”.(See figure below.)

If on Linux: Find the name of the main network interface by typing “ifconfig” and observing the output.

The interface may be called “eth0” or something else. Now use the “dhclient” command to first r e-

lease the leased IP address and then to renew the lease. Type, for example, “sudodhclient –r

eth0” to do the release followed by “sudodhclient eth0” to renew the lease.

Figure 5: Releasing and renewing the IP address on Windows 3.Once you have captured some DHCP traffic, stop the capture.

Step 2: Inspect the Trace

In this step and the steps that follow, we will inspect only the short DHCP exchange described above. This is because the traffic you have captured can vary widely across settings. You may have as few as two DHCP packets on a quiet network or many DHCP packets on a busy network (especially if a class is running this lab!). The details of DHCP packets may vary depending on how the computers implement DHCP. There may be multiple packets of a single kind in an exchange due to replicated servers, and dif-ferent types of DHCP packets too.

Look for the shortDHCP exchange (of a DHCP Request packet followed by a DHCP Ack packet) in your trace. Select the DHCP Request packet, and observe the protocol stack to see how DHCP messages are carried. The link protocol is likely Ethernet, and the next higher protocol is IP. Then comes UDP, so each DHCP message is carried in a UDP packet. On top of UDP, Wireshark is likely to say BOOTP (Bootstrap Protocol) instead of DHCP. This is a bit confusing, but DHCP is implemented as an extension of an older protocol called BOOTP. You can think of the BOOTP section as the DHCP header and message. An exam-ple window is shown below.

Figure 3: Capture of DHCP packets, showing details of a DHCP Request

Expand the BOOTP (DHCP) section (using the “+” expander or icon) to look at the details of a DHCP Re-quest message. There are many fields, and we will only point out a few rather than cover them all. These fields are carried in all DHCP messages, though they have different values in different messages.

?The message begins with a Message Type. It is a Boot Request, which is used for all DHCP mes-sages sent from your computer to a DHCP server.

?After a few fields there is a Transaction ID field. All DHCP packets in a specific exchange between

a client and server carry the same transaction ID; that is how both ends know that the packets

belong to the exchange rather than another concurrent DHCP operation.

?There are several IP address fields. These fields are used to carry IP addresses such as the one that the computer is being assigned.

?There is a Magic Cookie field. It carries a value that indicates the rest of the message contains a series of DHCP Options. That is, this really is a DHCP message, not a BOOTP message.

?Each DHCP option is self-contained, with a type code saying what it represents, along with a length and value. The first option is DHCP Message Type, which says what kind of DHCP message is being carried. The other options vary with the type of DHCP message. For example, a DHCP

Request will have aRequested IP Address option to ask for a specific address, which a DHCP Ack will have a IP Address Lease Time option to say for how long the IP address is being assigned.

Now select a DHCP Ack packet and compare the BOOTP fields. We will ask questions about these fields in the next section, but for now want you to observe that the DHCP Ack has the same overall format, but different values for the fields and carries different DHCP options.

You can browse the options for DHCP Requests and Acks to learn about DHCP. You can see, for example, how long the IP address is assigned by the server, whether seconds, minutes, hours or days.You will also see the other configuration parameters that are assigned by the DHCP server, such as the IP address of the domain name server and router, the subnet mask, the domain name for the host, and more.

You can also try to make out the whole sequence of DHCP messages that is exchanged for your network setup. If may be as simple as the short exchange of Request and Ack, or it may be the complete ex-change of Discover, Offer, Request and Ack. It may have additional messages such as Release, and it may have multiple of the messages (e.g., two or more Offers or Acks) due to multiple local DHCP servers. Complicating the exchange with your computer is that the trace may capture concurrent DHCP traffic from other local computers. You can use the Transaction IDs to separate the different exchanges, and look at the Ethernet source address to see which DHCP messages were sent by your computer. It is likely that other DHCP traffic is mixed in with your exchange.

Step 3: Details of DHCP Messages

Spend time understanding DHCP. Note the position of the Ethernet, IP, UDP, and BOOTP protocol block. Answer the following questions based on your examination of the BOOTP/DHCP fields for both the DHCP Request and DHCP Ack. Answers on next page.

1.What are the two values of the BOOTP Message Type field?

2.How long is the Transaction ID field? Say whether it is likely that concurrent DHCP operations

done by different computers will happen to pick the same Transaction ID.

3.What is the name of the field that carries the IP address that is being assigned to the client?You

will find this field filled in on the DHCP Ack, as that message is completing the assignment.

4. What is the value of the Magic Cookie that stands for DHCP?

5.The first DHCP option is DHCP Message Type. What option value stands for this type?

6.DHCP Requests will typically have a Client Identifier option. Look at the value of this option. How

does it identify the client? Take a guess.

7.DHCP Acks will typically have a Server Identifier option. Look at the value of this option. How

does it identify the server? Take a guess.

8.What option value stands for the Requested IP Address option? And for the IP Address Lease

Time option?

9.How does the recipient of a DHCP message know that it has reached the last option?

Step 3: Answers to details of DHCP Messages

Figure 1: Structure of a DHCP message

1. The two values are Boot Request (1) and Boot Reply (2).

2. The Transaction ID is 4 bytes long. Thus it is very unlikely that there will be collisions in a relative-ly small number of concurrent DHCP operations (until that number approaches 216!)

The “Your (client) IP address” field carries the IP address being leased to the client. 4.

The DHCP magic cookie value is 0x63825363. 5. The option value of 53 stands for DHCP Message Type.

6. It is typical for the Client Identifier to carry the Ethernet address of the client, but possible to use some other kind of identifier (e.g., hostname, serial number).

7. It is typical for the Server Identifier to carry the IP address of the DHCP server, but possible to use some other kind of identifier.

8. The option value of 50 stands for Requested IP Address and the value of 51 stands for IP Address Lease Time.

9. The end of the DHCP options is identified with a DHCP option called End with value 255. Ether-

net IP header UDP header BOOTP fields DHCP Op-tions

Step 4: DHCP Message Addressing

Now we will look at how DHCP messages are addressed to computers at the UDP, IP and Ethernet layers. This is interesting because DHCP is used to assign IP addresses – a computer requesting a DHCP address may neither have its own IP address nor know the IP address of the DHCP server.

Start by selecting a DHCP Request packet and looking at its UDP details in the middle Wireshark panel. We will only look at the DHCP Request message to keep things simple, as the details of addressing differ for other DHCP messages. Answers on next page.

1.What port number does the DHCP client use, and what port number does the DHCP server use?

Ports matter because UDP messages are addressed using ports. Both of these port numbers are on the Request in the source and destination port fields (and you will also see them on the Ack). Now look at the IP addresses in the IP protocol header of the packet for the next question. Do not look inside the BOOTP fields for the DHCP parameters, as we care about how DHCP messages are addressed at lower protocol layers. When the request is sent, your computer has no IP address and may not even know the IP address of the DHCP server, so the IP addressing differs from a routine IP packet.

2.What source IP address is put on the Request message?It is a special value meaning “this host

on this network” used for initialization.

3.What destination IP address is put on the Request message? It is also a reserved value designed

to reach the DHCP server wherever it is on the local network.

Finally, look at the Ethernet addresses for the next question.

4.What source Ethernet address is put on the Request message, and what destination Ethernet

address is put on the Request message? One of these addresses is a reserved address. Looking at the addressing should help you to understand why your computer may record the DHCP traf-fic of other local computers in your trace. Since the IP addressing is not yet established, many DHCP messages are sent to all computers on the local network. This makes sure every computer receives DHCP messages intended for them, but it poses a difficulty: one computer may receive DHCP messages intended for another computer.

5.How does a computer work out whether a DHCP message it receives is intended as a reply to its

DHCP Request message, and not a reply to another computer? Hint: if you are not sure then go over the fields you inspected previously in Step 2 above.

Step 4: Answers to DHCP Message Addressing

1. The DHCP client (your computer) uses UDP port 68 and the DHCP server uses UDP port 67.

2. The source IP address is 0.0.0.0. It is a special address used during address initialization.

3. The destination IP address is 255.255.255.255. It is the broadcast address, which means the mes-sage is intended for all computers on the network. (It is not possible to use a more restricted subnet broadcast, e.g., 192.168.255.255, as the subnet mask is not yet known by the client.)

4. The source Ethernet addres s is simply your own computer’s Ethernet address, since that is a l-ready assigned to your NIC. The destination Ethernet address is ff:ff:ff:ff:ff:ff, the reserved broadcast Ethernet address, so that the packet reaches all computers on the local network.

5. The DHCP messages in a single exchange carry the same Transaction ID. Thus a computer looks for a DHCP reply such as an Ack with a Transaction ID that matches the value it placed on the earlier DHCP message such as a Request. (This is in addition to any Ethernet address filtering: if the reply is un-icast then it will have the computer’s Ethernet address as its destination.)

Wireshark使用教程详解,带实例

Wireshark教程带实例第 1 章介绍 1.1. 什么是Wireshark Wireshark 是网络包分析工具。网络包分析工具的主要作用是尝试捕获网络包，并尝试显示包的尽可能详细的情况。你可以把网络包分析工具当成是一种用来测量有什么东西从网线上进出的测量工具，就好像使电工用来测量进入电信的电量的电度表一样。（当然比那个更高级）过去的此类工具要么是过于昂贵，要么是属于某人私有，或者是二者兼顾。 Wireshark出现以后，这种现状得以改变。Wireshark可能算得上是今天能使用的最好的开元网络分析软件。 1.1.1. 主要应用下面是Wireshark一些应用的举例： ?网络管理员用来解决网络问题 ?网络安全工程师用来检测安全隐患 ?开发人员用来测试协议执行情况 ?用来学习网络协议除了上面提到的，Wireshark还可以用在其它许多场合。 1.1. 2. 特性 ?支持UNIX和Windows平台 ?在接口实时捕捉包 ?能详细显示包的详细协议信息 ?可以打开/保存捕捉的包 ?可以导入导出其他捕捉程序支持的包数据格式 ?可以通过多种方式过滤包 ?多种方式查找包 ?通过过滤以多种色彩显示包 ?创建多种统计分析 ?…还有许多不管怎么说，要想真正了解它的强大，您还得使用它才行

图 1.1. Wireshark捕捉包并允许您检视其内 1.1.3. 捕捉多种网络接口 Wireshark 可以捕捉多种网络接口类型的包，哪怕是无线局域网接口。想了解支持的所有网络接口类型，可以在我们的网站上找到https://www.wendangku.net/doc/ef11138099.html,/CaptureSetup/NetworkMedia. 1.1.4. 支持多种其它程序捕捉的文件 Wireshark可以打开多种网络分析软件捕捉的包，详见??? 1.1.5. 支持多格式输出 Wieshark可以将捕捉文件输出为多种其他捕捉软件支持的格式，详见??? 1.1.6. 对多种协议解码提供支持可以支持许多协议的解码(在Wireshark中可能被称为解剖)??? 1.1.7. 开源软件 Wireshark是开源软件项目，用GPL协议发行。您可以免费在任意数量的机器上使用它，不用担心授权和付费问题，所有的源代码在GPL框架下都可以免费使用。因为以上原因，人们可以很容易在Wireshark上添加新的协议，或者将其作为插件整合到您的程序里，这种应用十分广泛。 1.1.8. Wireshark不能做的事 Wireshark不能提供如下功能 ?Wireshark不是入侵检测系统。如果他/她在您的网络做了一些他/她们不被允许的奇怪的事情，Wireshark不会警告您。但是如果发生了奇怪的事情，Wireshark可能对察看发生了什么会有所帮助。[3]?Wireshark不会处理网络事务，它仅仅是“测量”(监视)网络。Wireshark不会发送网络包或做其它交互性的事情（名称解析除外，但您也可以禁止解析）。 1.2. 系通需求

按章节练习及答案全部1-11章

第二章网络通讯选择关于网络协议的正确陈述。（选择三项）正确答案应该是1 3 5 定义特定层PDU 的结构规定实现协议层功能的方式概述层与层之间通信所需的功能限制了硬件兼容性需要取决于协议层的封装过程杜绝厂商之间的标准化 2下列哪些陈述正确指出了中间设备在网络中的作用？（选择三项）确定数据传输路径发起数据通信重新定时和重新传输数据信号发送数据流管理数据流数据流最后的终止点 3在封装过程中，数据链路层执行什么操作？不添加地址。添加逻辑地址。添加物理地址。添加进程的端口号。 4以下哪种特征正确代表了网络中的终端设备？

管理数据流发送数据流重新定时和重新传输数据信号确定数据传输路径 5什么是PDU？传输期间的帧损坏在目的设备上重组的数据因通信丢失而重新传输的数据包特定层的封装 6 请参见图示。所示网络属于哪一类型？ WAN MAN LAN WLAN

7通过检查网络层报头可以确定什么？本地介质上的目的设备用于到达目的主机的路径将要通过介质传输的比特创建数据的源应用程序或进程 8哪一层负责将数据段封装成数据包？物理层数据链路层网络层传输层 9封装的关键功能是什么？（选择三项）供传输前修改原始数据标识数据片段属于同一通信为通信提供统一的网络路径确保数据片段可以转发到正确的接收端设备实现完整消息的重组跟踪终端设备之间的延迟 10T CP/IP 网络接入层有何作用？路径确定和数据包交换数据表示、编码和控制

可靠性、流量控制和错误检测详细规定构成物理链路的组件及其接入方法将数据段划分为数据包 11下列哪三项陈述是对局域网(LAN) 最准确的描述？（选择三项） LAN 通常位于一个地域内。此类网络由由一个组织管理。 LAN 中的不同网段之间一般通过租用连接的方式连接。此类网络的安全和访问控制由服务提供商控制。 LAN 为同一个组织内的用户提供网络服务和应用程序访问。此类网络的每个终端通常都连接到电信服务提供商(TSP)。 12 请参见图示。哪个术语正确判断出了包含于绿色区域中的设备类型？源终端传输

Wireshark抓包实验报告.

第一次实验：利用Wireshark软件进行数据包抓取 1.3.2 抓取一次完整的网络通信过程的数据包实验一，实验目的：通过本次实验，学生能掌握使用Wireshark抓取ping命令的完整通信过程的数据包的技能，熟悉Wireshark软件的包过滤设置和数据显示功能的使用。二，实验环境：操作系统为Windows 7,抓包工具为Wireshark. 三，实验原理： ping是用来测试网络连通性的命令，一旦发出ping命令，主机会发出连续的测试数据包到网络中，在通常的情况下，主机会收到回应数据包，ping采用的是ICMP协议。四，验步骤： 1.确定目标地址：选择https://www.wendangku.net/doc/ef11138099.html,作为目标地址。 2.配置过滤器：针对协议进行过滤设置，ping使用的是ICMP协议，抓包前使用捕捉过滤器，过滤设置为icmp,如图 1- 1

图 1-1 3.启动抓包：点击【start】开始抓包，在命令提示符下键入ping https://www.wendangku.net/doc/ef11138099.html,, 如图 1-2

图 1-2 停止抓包后，截取的数据如图 1-3 图 1-3 4，分析数据包：选取一个数据包进行分析，如图1- 4

图1-4 每一个包都是通过数据链路层DLC协议，IP协议和ICMP协议共三层协议的封装。DLC协议的目的和源地址是MAC地址，IP协议的目的和源地址是IP地址，这层主要负责将上层收到的信息发送出去，而ICMP协议主要是Type和Code来识别，“Type:8,Code：0”表示报文类型为诊断报文的请求测试包，“Type:0,Code:0”表示报文类型为诊断报文类型请正常的包。ICMP提供多种类型的消息为源端节点提供网络额故障信息反馈，报文类型可归纳如下：（1）诊断报文（类型：8，代码0；类型：0代码：0）； (2）目的不可达报文（类型：3，代码0-15）；（3）重定向报文（类型：5，代码：0--4）；（4）超时报文（类型：11，代码：0--1）；（5）信息报文（类型：12--18）。

wireshark捕获器使用教程

Wireshark的捕捉过滤器和显示过滤器 Wireshark两种过滤器使用的语法是完全不同的。我们将在接下来的几页中对它们进行介绍： 1. 捕捉过滤器捕捉过滤器的语法与其它使用Lipcap（Linux）或者Winpcap（Windows）库开发的软件一样，比如著名的TCPdump。捕捉过滤器必须在开始捕捉前设置完毕，这一点跟显示过滤器是不同的。设置捕捉过滤器的步骤是： - 选择capture -> options。 - 填写"capture filter"栏或者点击"capture filter"按钮为您的过滤器起一个名字并保存，以便在今后的捕捉中继续使用这个过滤器。 - 点击开始（Start）进行捕捉。

语法：例子：tcp dst 10.1.1.1 80 and tcp dst 10.2.2.2 3128 Protocol（协议）: 可能的值: ether, fddi, ip, arp, rarp, decnet, lat, sca, moprc, mopdl, tcp and udp. 如果没有特别指明是什么协议，则默认使用所有支持的协议。 Direction（方向）: 可能的值: src, dst, src and dst, src or dst 如果没有特别指明来源或目的地，则默认使用"src or dst" 作为关键字。例如，"host 10.2.2.2"与"src or dst host 10.2.2.2"是一样的。Host(s): 可能的值：net, port, host, portrange. 如果没有指定此值，则默认使用"host"关键字。

wireshark练习及答案lab-tcp

Lab Exercise – TCP Objective To see the details of TCP (Transmission Control Protocol). TCP is the main transport layer protocol used in the Internet. The trace file is here: https://www.wendangku.net/doc/ef11138099.html,/~kevin/com320/labs/wireshark/trace-tcp.pcap Requirements Wireshark: This lab uses Wireshark to capture or examine a packet trace. A packet trace is a record of traffic at some location on the network, as if a snapshot was taken of all the bits that passed across a particular wire. The packet trace records a timestamp for each packet, along with the bits that make up the packet, from the low-layer headers to the higher-layer contents. Wireshark runs on most operating systems, including Windows, Mac and Linux. It provides a graphical UI that shows the sequence of pack-ets and the meaning of the bits when interpreted as protocol headers and data. The packets are color-coded to convey their meaning, and Wireshark includes various ways to filter and analyze them to let you investigate different aspects of behavior. It is widely used to troubleshoot networks. You can down-load Wireshark from https://www.wendangku.net/doc/ef11138099.html, if it is not already installed on your computer. We highly rec-ommend that you watch the short, 5 minute video “Introduction to Wireshark” that is on the site. wget / curl: This lab uses wget (Linux and Windows) and curl (Mac) to fetch web resources. wget and curl are command-line programs that let you fetch a URL. Unlike a web browser, which fetches and executes entire pages, wget and curl give you control over exactly which URLs you fetch and when you fetch them. Under Linux, wget can be installed via your package manager. Under Windows, wget is available as a binary at my site https://www.wendangku.net/doc/ef11138099.html,/~kevin/com320/labs/wget.exe or look for download information on https://www.wendangku.net/doc/ef11138099.html,/software/wget/. Both have many options (try “wget --help” or “curl --help” to see) but a URL can be fetched simply with “wget URL” or “curl URL”. Browser: This lab uses a web browser to find or fetch pages as a workload. Any web browser will do.

实验一-Wireshark的安装与使用

一、实验目的 1、熟悉并掌握Wireshark的基本使用； 2、了解网络协议实体间进行交互以及报文交换的情况。二、实验环境与因特网连接的计算机，操作系统为Windows，安装有Wireshark、IE等软件。三、预备知识要深入理解网络协议，需要观察它们的工作过程并使用它们，即观察两个协议实体之间交换的报文序列，探究协议操作的细节，使协议实体执行某些动作，观察这些动作及其影响。这种观察可以在仿真环境下或在因特网这样的真实网络环境中完成。观察正在运行的协议实体间交换报文的基本工具被称为分组嗅探器（packet sniffer），又称分组捕获器。顾名思义，分组嗅探器捕获（嗅探）你的计算机发送和接收的报文。图显示了一个分组嗅探器的结构。图分组嗅探器的结构图右边是计算机上正常运行的协议和应用程序（如：Web浏览器和FTP客户端）。分组嗅探器（虚线框中的部分）主要有两部分组成：第一是分组捕获器，其功能是捕获计算机发送和接收的每一个链路层帧的拷贝；第二个组成部分是分组分析器，其作用是分析并显示协议报文所有字段的内容（它能识别目前使用的各种网络协议）。 Wireshark是一种可以运行在Windows, UNIX, Linux等操作系统上的分组

嗅探器，是一个开源免费软件，可以从下载。运行Wireshark 程序时，其图形用户界面如图所示。最初，各窗口中并无数据显示。Wireshark 的界面主要有五个组成部分：命令和菜单协议筛选框捕获分组列表选定分组首部明细分组内容左：十六进制右：ASCII码图 Wireshark 主界面命令菜单（command menus）：命令菜单位于窗口的最顶部，是标准的下拉式菜单。协议筛选框（display filter specification）：在该处填写某种协议的名称，Wireshark据此对分组列表窗口中的分组进行过滤，只显示你需要的分组。捕获分组列表（listing of captured packets）：按行显示已被捕获的分组内容，其中包括：分组序号、捕获时间、源地址和目的地址、协议类型、协议信息说明。单击某一列的列名，可以使分组列表按指定列排序。其中，协议类型是发送或接收分组的最高层协议的类型。分组首部明细（details of selected packet header）：显示捕获分组列表窗口中被选中分组的首部详细信息。包括该分组的各个层次的首部信息，需要查看哪层信息，双击对应层次或单击该层最前面的“＋”即可。分组内容窗口（packet content）：分别以十六进制（左）和ASCII码（右）两种格式显示被捕获帧的完整内容。

wireshark抓包分析实验报告

Wireshark抓包分析实验若惜年一、实验目的： 1.学习安装使用wireshark软件，能在电脑上抓包。 2.对抓出包进行分析，分析得到的报文，并与学习到的知识相互印证。二、实验内容：使用抓包软件抓取HTTP协议通信的网络数据和DNS通信的网络数据，分析对应的HTTP、TCP、IP协议和DNS、UDP、IP协议。三、实验正文： IP报文分析：从图中可以看出： IP报文版本号为:IPV4 首部长度为:20 bytes 数据包长度为:40 标识符：0xd74b 标志：0x02 比特偏移：0 寿命：48 上层协议：TCP 首部校验和：0x5c12 源IP地址为：119.75.222.18 目的IP为：192.168.1.108

从图中可以看出：源端口号：1891 目的端口号：8000 udp报文长度为：28 检验和：0x58d7 数据长度：20 bytes UDP协议是一种无需建立连接的协议，它的报文格式很简单。当主机中的DNS 应用程序想要惊醒一次查询时，它构造一个DNS查询报文段并把它给UDP，不需要UDP之间握手，UDP为报文加上首部字段，将报文段交给网络层。

第一次握手：从图中看出：源端口号：56770 目的端口号：80 序列号为:0 首部长为: 32 bytes SYN为1表示建立连接成功当fin为1时表示删除连接。

第二次握手：从图中看出：源端口号是：80 目的端口号为：56770 序列号为：0 ack为：1 Acknowledgement为1表示包含确认的报文Syn为1表示建立连接。

第三次握手：从图中看出：源端口：56770 目的端口：80 序列号为：1 ACK为：1 首部长为：20bytes Acknowledgement为1表示包含确认的报文所以，看出来这是TCP连接成功了 Tcp是因特网运输层的面向连接的可靠的运输协议，在一个应用进程可以开始向另一个应用进程发送数据前，这两个进程必须先握手，即它们必须相互发送预备文段，建立确保传输的参数。

wireshark抓包教程

Wireshark图解教程（简介、抓包、过滤器）配置 Wireshark是世界上最流行的网络分析工具。这个强大的工具可以捕捉网络中的数据，并为用户提供关于网络和上层协议的各种信息。与很多其他网络工具一样，Wireshark也使用pcap network library来进行封包捕捉。可破解局域网内QQ、邮箱、msn、账号等的密码！！ Wireshark是世界上最流行的网络分析工具。这个强大的工具可以捕捉网络中的数据，并为用户提供关于网络和上层协议的各种信息。与很多其他网络工具一样，Wireshark也使用pcap network library来进行封包捕捉。可破解局域网内QQ、邮箱、msn、账号等的密码！！ wireshark的原名是Ethereal，新名字是2006年起用的。当时Ethereal的主要开发者决定离开他原来供职的公司，并继续开发这个软件。但由于Ethereal这个名称的使用权已经被原来那个公司注册，Wireshark这个新名字也就应运而生了。在成功运行Wireshark之后，我们就可以进入下一步，更进一步了解这个强大的工具。下面是一张地址为192.168.1.2 的计算机正在访问“https://www.wendangku.net/doc/ef11138099.html,”网站时的截图。 1.MENUS（菜单） 2.SHORTCUTS（快捷方式） 3.DISPLAY FILTER（显示过滤器） 4.PACKET LIST PANE（封包列表) 5.PACKET DETAILS PANE（封包详细信息） 6.DISSECTOR PANE（16进制数据） 7.MISCELLANOUS（杂项）

1. MENUS（菜单）程序上方的8个菜单项用于对Wireshark进行配置： -"File"（文件）-"Edit"（编辑）-"View"（查看）-"Go"（转到）-"Capture"（捕获）-"Analyze"（分析）-"Statistics"（统计） -"Help"（帮助）打开或保存捕获的信息。查找或标记封包。进行全局设置。设置Wireshark的视图。跳转到捕获的数据。设置捕捉过滤器并开始捕捉。设置分析选项。查看Wireshark的统计信息。查看本地或者在线支持。 2. SHORTCUTS（快捷方式）在菜单下面，是一些常用的快捷按钮。您可以将鼠标指针移动到某个图标上以获得其功能说明。 3.DISPLAY FILTER（显示过滤器）显示过滤器用于查找捕捉记录中的内容。请不要将捕捉过滤器和显示过滤器的概念相混淆。请参考Wireshark过滤器中的详细内容。返回页面顶部 4.PACKET LIST PANE（封包列表）

wireshark练习及答案lab-protocol-layers

Lab Exercise – Protocol Layers Objective To learn how protocols and layering are represented in packets. They are key concepts for structuring networks that are covered in the text. The trace for this lab is here: https://www.wendangku.net/doc/ef11138099.html,/~kevin/com320/labs/wireshark/trace-protocol-layers.pcap (although the main trace you will look at is from a site you pick such as https://www.wendangku.net/doc/ef11138099.html, in the exam-ples which follow). Requirements Wireshark: This lab uses the Wireshark software tool to capture andexamine a packet trace. A packet trace is a record of traffic at a location on the network, as if a snapshot was taken of all the bits that passed across a particular wire. The packet trace records a timestamp for each packet, along with the bits that make up the packet, from the lower-layer headers to the higher-layer contents.Wireshark runs on most operating systems, including Windows, Mac and Linux. It provides a graphical UI that shows the sequence of packets and the meaning of the bits when interpreted as protocol headers and data. It col-or-codes packets by their type, and has various ways to filter and analyze packets to let you investigate the behavior of network protocols. Wireshark is widely used to troubleshoot networks. You can down-load it https://www.wendangku.net/doc/ef11138099.html, for your personal computer. It is an ideal packet analyzer for our labs –it is stable, has a large user base and well-documented support that includes a user-guide https://www.wendangku.net/doc/ef11138099.html,/docs/wsug_html_chunked), and a detailed FAQ, rich functionality that in-cludes the capability to analyze hundreds of protocols, and a well-designed user interface. It operates in computers using Ethernet, serial (PPP and SLIP), 802.11 wireless LANs, and many other link-layer tech-nologies (if the OS on which it is running allows Wireshark to do so). It is already installed in the labs. A quick help guide to Wireshark display filters is here: https://www.wendangku.net/doc/ef11138099.html,/wireshark_filters.php Wireshark is a core tool for any wireless ‘man in the middle’ or similar snooping attack. It is simply i n-dispensable for those who wish to examine packets being transferred over a network –good or bad…..

计算机网络实验Wireshark

计算机网络实验指导书

目录实验一Wireshark的安装与使用 (3) 实验二使用Wireshark分析以太网帧与ARP协议 (7) 实验三使用Wireshark分析IP协议 (11) 实验四利用Wireshark分析ICMP (19) 实验五使用Wireshark分析UDP协议 (25) 实验六使用Wireshark分析TCP协议 (29) 实验七利用Wireshark分析协议HTTP (35) 实验八利用Wireshark分析DNS协议 (40) 实验九使用Wireshark分析FTP协议(选作) (44) 实验十使用Wireshark分析SMTP与POP3协议(选作) (48)

实验一Wireshark的安装与使用一、实验目的 1、熟悉并掌握Wireshark的基本使用; 2、了解网络协议实体间进行交互以及报文交换的情况。二、实验环境与因特网连接的计算机,操作系统为Windows,安装有Wireshark、IE等软件。三、预备知识要深入理解网络协议,需要观察它们的工作过程并使用它们,即观察两个协议实体之间交换的报文序列,探究协议操作的细节,使协议实体执行某些动作,观察这些动作及其影响。这种观察可以在仿真环境下或在因特网这样的真实网络环境中完成。观察正在运行的协议实体间交换报文的基本工具被称为分组嗅探器(packet sniffer),又称分组捕获器。顾名思义,分组嗅探器捕获(嗅探)您的计算机发送与接收的报文。图1显示了一个分组嗅探器的结构。图1 图1右边就是计算机上正常运行的协议与应用程序(如:Web浏览器与FTP客户端)。分组嗅探器(虚线框中的部分)主要有两部分组成:第一就是分组捕获器,其功能就是捕获计算机发送与接收的每一个链路层帧的拷贝;第二个组成部分就是分组分析器,其作用就是分析并显示协议报文所有字段的内容(它能识别目前使用的各种网络协议)。 Wireshark就是一种可以运行在Windows, UNIX, Linux等操作系统上的分组嗅探器,就是一个开源免费软件,可以从、wireshark、org下载。

Wireshark中文简明使用教程

第 3 章用户界面 . 须知现在您已经安装好了Wireshark,几乎可以马上捕捉您的一个包。紧接着的这一节我们将会介绍：Wireshark的用户界面如何使用如何捕捉包如何查看包如何过滤包 ……以及其他的一些工作。 . 启动Wireshark 你可以使用Shell命令行或者资源管理器启动Wireshark. 提示开始Wireshark 时您可以指定适当的参数。参见第节“从命令行启动Wireshark” 注意在后面的章节中，将会出现大量的截图，因为Wireshark运行在多个平台，并且支持多个GUI Toolkit2x),您的屏幕上显示的界面可能与截图不尽吻合。但在功能上不会有实质性区别。尽管有这些区别，也不会导致理解上的困难。 . 主窗口先来看看图“主窗口界面”，大多数打开捕捉包以后的界面都是这样子（如何捕捉/打开包文件随后提到）。图 . 主窗口界面和大多数图形界面程序一样，Wireshark主窗口由如下部分组成：

1.菜单（见第节“主菜单”）用于开始操作。 2. 主工具栏(见第节“"Main"工具栏”)提供快速访问菜单中经常用到的项目的功能。 3.Fiter toolbar/过滤工具栏(见第节“"Filter"工具栏”)提供处理当前显示过滤得方法。(见:”浏览时进行过滤”) 4.Packet List面板（见第节“"Pcaket List"面板”）显示打开文件的每个包的摘要。点击面板中的单独条目，包的其他情况将会显示在另外两个面板中。 5.Packet detail面板（见第节“"Packet Details"面板”）显示您在Packet list面板中选择的包德更多详情。 6.Packet bytes面板（见第节“"Packet Byte"面板”）显示您在Packet list面板选择的包的数据，以及在Packet details 面板高亮显示的字段。 7.状态栏（见第节“状态栏”）显示当前程序状态以及捕捉数据的更多详情。注意主界面的三个面版以及各组成部分可以自定义组织方式。见第节“首选项” 3.3.1. 主窗口概述 Packet list和Detail 面版控制可以通过快捷键进行。表“导航快捷键”显示了相关的快捷键列表。表“"GO"菜单项”有关于快捷键的更多介绍表 . 导航快捷键快捷键描述 Tab,Shift+Tab在两个项目间移动，例如从一个包列表移动到下一个 Down移动到下一个包或者下一个详情 Up移动到上一个包或者上一个详情 Ctrl-Down,F8移动到下一个包，即使焦点不在Packet list面版 Ctrl-UP,F7移动到前一个报，即使焦点不在Packet list面版 Left在Pactect Detail面版，关闭被选择的详情树状分支。如果以关闭，则返回到父分支。 Right在Packet Detail面版，打开被选择的树状分支. Backspace Packet Detail面版，返回到被选择的节点的父节点 Return,Enter Packet Detail面版，固定被选择树项目。另外，在主窗口键入任何字符都会填充到filter里面。 . 主菜单 Wireshark主菜单位于Wireshark窗口的最上方。图“主菜单”提供了菜单的基本界面。图 . 主菜单主菜单包括以下几个项目: File 包括打开、合并捕捉文件，save/保存,Print/打印,Export/导出捕捉文件的全部或部分。以及退出Wireshark项.见第节“"File"菜单” Edit 包括如下项目：查找包，时间参考，标记一个多个包，设置预设参数。（剪切，拷贝，粘贴不能立即执行。）见第节“"Edit"菜单” View 控制捕捉数据的显示方式，包括颜色，字体缩放，将包显示在分离的窗口，展开或收缩详情面版的地树状节点，……见第节“"View"菜单” GO 包含到指定包的功能。见第节“"Go"菜单”

思科章节练习第二章到第七章试题及答案

思科章节练习第二章到第七章试题及答案第二章 1.下列哪些陈述正确指出了中间设备在网络中的作用？（选择三项） (135) 确定数据传输路径发起数据通信重新定时和重新传输数据信号发送数据流管理数据流数据流最后的终止点 2.请选择关于网络协议的正确陈述。（选择三项。135）定义特定层 PDU 的结构规定实现协议层功能的方式概述层与层之间通信所需的功能限制了对硬件兼容性的需要需要取决于协议层的封装过程杜绝厂商之间的标准化 3.封装的两个功能是什么？（45选择两项）跟踪终端设备之间的延迟为通信提供统一的网络路径在传输前可以修改原始数据标识属于同一通信的数据片段确保数据片段可以转发到正确的接收端设备 4.数据链路层封装添加的报尾信息有何主要功能？1 支持差错校验确保数据按照顺序到达确保送达正确目的标识本地网络中的设备帮助中间设备进行处理和路径选择 5.OSI 模型哪两层的功能与 TCP/IP 模型的网络接入层相同？（选择两项34）网络层传输层物理层数据链路层会话层 6.什么是 PDU？4 传输期间的帧损坏在目的设备上重组的数据因通信丢失而重新传输的数据包特定层的封装 7.以下哪种特征正确代表了网络中的终端设备？ 2 管理数据流发送数据流重新定时和重新传输数据信号

确定数据传输路径 8.IP 地址为 10.0.0.34 的“手机A”已经与 IP 地址为 172.16.1.103 的“IP 电话1”建立了 IP 会话。请根据图示回答，下列哪个设备类型是对无线设备“手机A”功能的最准确描述？ 2 目的设备终端设备中间设备介质设备 9.下列哪三个标签正确标识了图示网段的网络类型？（236选择三项）网络 A -- WAN 网络 B -- WAN 网络 C -- LAN 网络 B -- MAN 网络 C -- WAN 网络 A -- LAN 10.下列哪三项陈述是对局域网 (LAN) 最准确的描述？（选择三项125） LAN 通常位于一个地域内。此类网络由由一个组织管理。 LAN 中的不同网段之间一般通过租用连接的方式连接。此类网络的安全和访问控制由服务提供商控制。 LAN 为同一个组织内的用户提供网络服务和应用程序访问。此类网络的每个终端通常都连接到电信服务提供商 (TSP)。 11. 哪个网络术语描述了图中所示的数据交替发送过程？4 通道 PDU 流传输多路复用封装 12第 4 层端口指定的主要作用是什么？5 标识本地介质中的设备标识源设备和目的设备之间的跳数向中间设备标识通过该网络的最佳路径标识正在通信的源终端设备和目的终端设备标识终端设备内正在通信的进程或服务 13. 哪种设备被视为中间设备？ 5 文件服务器 IP 电话笔记本电脑打印机交换机 14.哪个术语正确判断出了包含于区域 B 中的设备类型？ 4 源设备终端设备

实验一 wireshark抓包工具使用

实验一wireshark抓包工具使用[实验目的] 学习wireshark抓包工具的使用了解wireshark抓包工具的功能通过学习，进一步理解协议及网络体系结构思想 [实验原理] Wireshark是网络包分析工具。网络包分析工具的主要作用是尝试捕获网络包，并尝试显示包的尽可能详细的情况。主要应用：网络管理员用来解决网络问题网络安全工程师用来检测安全隐患开发人员用来测试协议执行情况用来学习网络协议 [实验内容] 下载WIRESHARK，学习工具的使用和功能。

Wireshark 是网络包分析工具。网络包分析工具的主要作用是尝试捕获网络包，并尝试显示包的尽可能详细的情况。你可以把网络包分析工具当成是一种用来测量有什么东西从网线上进出的测量工具，就好像使电工用来测量进入电信的电量的电度表一样。（当然比那个更高级）过去的此类工具要么是过于昂贵，要么是属于某人私有，或者是二者兼顾。 Wireshark出现以后，这种现状得以改变。 Wireshark可能算得上是今天能使用的最好的开元网络分析软件。工作流程（1）确定Wireshark的位置。如果没有一个正确的位置，启动Wireshark后会花费很长的时间捕获一些与自己无关的数据。（2）选择捕获接口。一般都是选择连接到Internet网络的接口，这样才可以捕获到与网络相关的数据。否则，捕获到的其它数据对自己也没有任何帮助。（3）使用捕获过滤器。通过设置捕获过滤器，可以避免产生过大的捕获文件。这样用户在分析数据时，也不会受其它数据干扰。而且，还可以为用户节约大量的时间。（4）使用显示过滤器。通常使用捕获过滤器过滤后的数据，往往还是很复杂。为了使过滤的数据包再更细致，此时使用显示过滤器进行过滤。（5）使用着色规则。通常使用显示过滤器过滤后的数据，都是有用的数据包。如果想更加突出的显示某个会话，可以使用着色规则高亮显示。（6）构建图表。如果用户想要更明显的看出一个网络中数据的变化情况，使用图表的形式可以很方便的展现数据分布情况。

Wireshark使用教程(精品)

Wireshark使用教程第 1 章介绍 1.1. 什么是Wireshark Wireshark 是网络包分析工具。网络包分析工具的主要作用是尝试捕获网络包，并尝试显示包的尽可能详细的情况。你可以把网络包分析工具当成是一种用来测量有什么东西从网线上进出的测量工具，就好像使电工用来测量进入电信的电量的电度表一样。（当然比那个更高级）过去的此类工具要么是过于昂贵，要么是属于某人私有，或者是二者兼顾。 Wireshark出现以后，这种现状得以改变。Wireshark可能算得上是今天能使用的最好的开元网络分析软件。 1.1.1. 主要应用下面是Wireshark一些应用的举例： ?网络管理员用来解决网络问题 ?网络安全工程师用来检测安全隐患 ?开发人员用来测试协议执行情况 ?用来学习网络协议除了上面提到的，Wireshark还可以用在其它许多场合。 1.1. 2. 特性 ?支持UNIX和Windows平台 ?在接口实时捕捉包 ?能详细显示包的详细协议信息 ?可以打开/保存捕捉的包 ?可以导入导出其他捕捉程序支持的包数据格式 ?可以通过多种方式过滤包 ?多种方式查找包 ?通过过滤以多种色彩显示包 ?创建多种统计分析 ?…还有许多不管怎么说，要想真正了解它的强大，您还得使用它才行

wireshark练习及答案lab-dns.doc

Lab Exercise – DNS Objective DNS (Domain Name System) is the system & protocol that translates domain names to IP addresses . Step 1: Analyse the supplied DNS Trace Here we examine the supplied trace of a browser making DNS requests as follows. The trace is here: https://www.wendangku.net/doc/ef11138099.html,/~kevin/com320/labs/wireshark/trace-dns.pcap https://www.wendangku.net/doc/ef11138099.html,unch Wireshark and start a capture with a filter of “udp port 53”.We use this filterbe- cause there is no shorthand for DNS, but DNS is normally carried on UDP port 53. Figure 3: Setting up the capture options

Step 2: Inspect the Trace To explore the details of DNS packets, select a DNS query expand its Domain Name System block (by us-ing the “+” expander or icon). Your display should be similar to the one shown in our figure, with a series of packets with protocol DNS.. We have selected the first DNS message. Figure 3: Trace of DNStraffic showing the details of the DNS header Look for the following details: ?The DNS block follows the IP and UDP blocks. This is because DNS messages are carried in UDP segments within IP packets. You will see that the UDP port used by a nameserver is 53. ?The DNS header starts with a Transaction ID that is used to link a request and the corresponding reply – they both carry the same Transaction ID. ?Next come a set of flags that you can expand. They indicate whether the DNS message is a query or response, amongst other details. ?Then comethe number of query, answer, authority and additional records. These fields conclude the header.