用Wireshark進(jìn)行IP協(xié)議分析

1、TCP/IP 實 驗 報 告實驗4用Wireshark進(jìn)行IP協(xié)議分析 學(xué) 院 計算機(jī)學(xué)院 專 業(yè) 網(wǎng)絡(luò)工程 班 級 1班 姓 名 劉小芳 學(xué) 號 2012 5 4.1 實驗性質(zhì)本實驗為操作分析性實驗。4.2 實驗?zāi)康?. 掌握Wireshark軟件的基本使用方法。2. 掌握基本的網(wǎng)絡(luò)協(xié)議分析方法。3. 使用Wireshark抓包工具，分析IP數(shù)據(jù)報的格式。4. 加深理解IP協(xié)議的原理及其工作過程。4.3 實驗環(huán)境1. 硬件環(huán)境：PC機(jī)1臺。2. 網(wǎng)絡(luò)環(huán)境：PC機(jī)接入LAN或Internet。物理地址：00-E0-4C-00-16-78Ip地址：192.168.0.1313. 軟件環(huán)境：Win

2、dows操作系統(tǒng)和Wireshark軟件。4.4 實驗學(xué)時1. Capturing packets from an execution of traceroute2. A look at the captured traceWhat is the IP address of your computer?2. Within the IP packet header, what is the value in the upper layer protocol field?3. How many bytes are in the IP header? How many bytes are in th

3、e payload of theIP datagram? Explain how you determined the number of payload bytes.4. Has this IP datagram been fragmented? Explain how you determined whether ornot the datagram has been fragmented.Use the down arrow on your keyboard to move through the ICMP messages sentby your computer.5. Which f

4、ields in the IP datagram always change from one datagram to the nextwithin this series of ICMP messages sent by your computer?6. Which fields stay constant? Which of the fields must stay constant? Which fieldsmust change? Why?7. Describe the pattern you see in the values in the Identification field

5、of the IPDatagramNext (with the packets still sorted by source address) find the series of ICMP TTLexceededreplies sent to your computer by the nearest (first hop) router.8. What is the value in the Identification field and the TTL field?9. Do these values remain unchanged for all of the ICMP TTL-ex

6、ceeded replies sentto your computer by the nearest (first hop) router? Why?FragmentationSort the packet listing according to time again by clicking on the Time column.10. Find the first ICMP Echo Request message that was sent by your computer afteryou changed the Packet Size in pingplotter to be 200

7、0. Has that message beenfragmented across more than one IP datagram?11. Print out the first fragment of the fragmented IP datagram. What information inthe IP header indicates that the datagram been fragmented? What information inHow long is this IP datagram?12. Print out the second fragment of the f

8、ragmented IP datagram. What information inthe IP header indicates that this is not the first datagram fragment? Are the morefragments? How can you tell?13. What fields change in the IP header between the first and second fragment?Now find the first ICMP Echo Request message that was sent by your computer after youchanged the Packet Size in pingplotter to be 3500.14. How many fragments were created from the original datagram?15. What fields change in the IP header among the fragments?4.5 實驗內(nèi)容與要求4.5.1 啟動Wireshark協(xié)議分析工具4.5.2 抓取IP數(shù)據(jù)包4.5.3分析IP報文、1. Capturing a bulk TCP transfer from your com