使用包嗅探及協(xié)議分析軟件Ethereal分析高層協(xié)議

1、計算機(jī)網(wǎng)絡(luò)課程實驗報告姓名院系自動化學(xué)院學(xué)號實驗地點東校區(qū)機(jī)房實驗時間實驗課體現(xiàn)出勤、體現(xiàn)得分實驗報告 得分實驗總分操作成果得分實驗?zāi)咳丈?掌握合同分析軟件Ethereal日勺使用措施;實驗內(nèi)容：1.捕獲局域網(wǎng)上本機(jī)（假設(shè)為主機(jī).53）發(fā)出或接受日勺所有ARP包，Ethereal日勺capture filter日勺filter string設(shè)立為：arp host 10.14.26.53.主機(jī).53上執(zhí)行” arp -d * ”清除arp緩存.p Docunents And Setting,fidniJiistrAto*a.!*p -d *G； Documents and Sett ingsi

2、stratorping 222.205.42.200Pinging 222 20 T42.300 with 33 btes qfTTL-120TT1=128TTL=128TTL=12QReplii fron 222 -205-42.200： bytes-32 t 恤ply ffor 222 _20E_42.200: btes=32 tine, Apiproxinate round tr-ip tines in nilli-seconds:Mininiun = Maxirium = 0ms= Bns.觀測并分析主機(jī).53發(fā)出或接受日勺所有ARP包，及arp包構(gòu)造。L 0.000000 no.42

3、,10,175 6roadSlAfip who has ?1O.42,1O?,10 Tell 105-1795.170786210.4M05.1S9BroidcsiARPwho has 310.43.105.155? Tell 210.42.105.1395.73733210.42.105.155210.42.105.18ARP210.42.105.155 is at sc:aB:6b:68:ef:7/27.358477210.42.105.18BroadcastARP的口 has 210.42.105.13G? Tell 210.4 2.105.18927.84W7210.42.105.13

4、0210.42.10.189ARP210.42.105.130 1s 就 ec:d8:611:6S:ef:cdMo. Time | Source|Cesunation,rwcol|nfoIE Frame 2 (J? bytes on 如；r% 42 byres captured)Arrival Time: Apr 24, 2014 18:44：43.177384000Time del:a from previous packer: 0r0QQ012QQ0 seiondsTime reference or first fr那ie： 0,000012000 secorxljFeri也 Hunbef

5、 : 2Packet Length: J2 bytesCipTure Lwgrti:顯 byre?prczccals，n rrame: eih:irpH Ethernet II, Src: 210.42.105,189 (ec:iB:6b:67:35:f5), Dst: 210.J2.105.179 Cec:a8:6b:66:05:lf) cr Inst Ion； 210.J2.105.179 O：: a玳砒：6配。，：if) s加rcw;職 Cec;aSi&b：67：3ijr5)Type: ARP (00S06E Address Resolufion prortotol (replyjrjr

6、dwire xype: Eihemsx CQxQOQlPrctccol type: IP (OmGSOO)hardwire size: WFCCTCiOl iZ6i 4opcode： reply (0 x0002)MAC address: 210.42.105.189 (ec:a8:6b:67:35:f5)binder M addrCJJ; 21O.42.1O5.189 (21Or42,105.189)Target MAC adless: 3102,105.179 (ec:6b:66:D5:lf)Target IP adless： 210.fl?.105.175 (210.42.105.179

7、)000000100020ec a86b6605iteca808 0006040002eca8ec a86b6605ifdzn6b 67 35 f5 08 06 00 016b 67 3S f5 d2 2a 69 bd69 b3 kt.*., kghi.*.kq5.?i.中0 x0001闡明硬件類型是以太網(wǎng)。Ox0800闡明合同類型是IP合同。高層合同為ARP合同，數(shù)據(jù) 報前面是端標(biāo)語0 x0800,類型字段為0 x0806,發(fā)送日勺ip地址為210.42,105.189，發(fā)送日勺MAC地址 為 ec： a8:6b： 67： 35： f5。接受勺 ip 地址為 210.42,105.179，接

8、受日勺 MAC 地址為 ec： a8:6b： 66： 05： 1f。2.捕獲局域網(wǎng)上日勺所有IP廣播包，Ethereal日勺capture filter日勺filter string設(shè)立為：ip broadcast(1).觀測并分析哪些節(jié)點在發(fā)廣播包，000000100020OOJO。禎MEff tt ft ff 懺 ff K &8 00 44 78 29 00 00 4011 ff ff Oe 11 OR 10 00 30 00 00 00 00 00 00 00 00 曲 Of 12 co 22 fl oa 4e 11北這些包日勺高層合同是什么？6b 6? 38 c6 08 00 43 0

9、0 cS af d2 h 69 i?ff ff b2 a9 28 00 11 QQ 00 00 00 00 02 00 00 00 bl 8e 3! ga 58 1c 2b e? 93 74111111kMN.虬i.1 1 F F 4 0 F T 1 1 1 1.J1Q.cjddaoci210-dJ-105=13355-255, ”5二隊UDsourcepor r :MW1peri:我口。20.51216Q210-42.105=1?255. 255-職確衛(wèi)駐UDPSourceport:3601Desrinati onpm 1：:36003CL 53 5 57210r4?B105-168255,

10、 25S. 255UDPArrpor t :M瀝1Destinat erim:獎。40-7C522421&.-lS.105iJ02255i255a255+255UDPSource1口 rt:3601Dexi nar1 Din:36001,027310口；LQ.4堂1 勤1B4i!55.23S.iJj-Sourceport i3W1nmt ,! o nport :6L脆湖Cl10-4?.105=10UDFSourceport =301&e?Tinationi)i：ir(:3600WCfTTlTnTBUDPSourceport:北。:LDestl natToirrport:a2.O1S227210

11、.42-105.113255.255- 2-5 2*5 5UDPSiDurcfiport:3601DSSTi MAT 1 onper e :36009芝，%，E35UDPSourceport:JWLDest nafi onport :M即。in7目71 flR 1 dn74% HIR 45 7與耳liinctnii iirjinnrr 31ntlCTl Kimr*iTW Ifirl -i ruiFr-sjms 7 (.82 byres on vlre, 92 byt&s captured)Arrival Time: Apr 247014 13：d9z44. W57640QOTlirte del

12、xa frcw previous packer: Q. 55-92750W secondsTrtit since reference ar firsT frMe 125105000 secondaFrame Nuitiber; 7backet: Lengrhi a? byreuCapTkW Length;pronocals in frwei sth：1pi：uolp:di,C4)Ethfirnat 113 src ec :aB;ftb;7;c& b, Dst 曰曠口qdvst. f-f: ff: ff ：；ff: ff ;ff )Oesx 1 nmEion; Braadc-ast (ff:ff

13、 :ff :ff zff :ff )Source: SC2aS6bsGTlSscG Cee:aSifibifi?33:匚Type： EP CQXOSQO)二 intfirrs PreooK Sir。： 2103,10,17 C210B?,105,1-67), P5X : A 衛(wèi)，A 5 , P55 C2 5 5 B 2 5 5 B 255,255 ) Version: 4 i-tead&r 1 ength:bytes田 oifferenTiaTeci servicw Fields qxoq (oscp oxw： oefauix; ecw： qkw)TC-il u&ngch：泌Icfent if

14、icafion: 0 x7S2S- I I U IIRUF10.000000210,42,105.145229.0.5.2UOPSourcepart:aoiDKtnafiQnport: 9101? 0-164765210.42AD5.lSd技，冷UDPSourceporx：3軻心苴!$ttn角ii 口由即300l日W 略京*葉.UDP妃 tinafTSrrport： tflOl41.721788210.42.105.IM255.255.25?.255UDPsourceponsM覘Oesfi nationP&fT:汗0。51,934135210.42.105-14?255.255.255.255

15、UDPsourcepori:3601DesfinafiDHport: 3600fl 3.922521Or4?.105,143255.255.255.UDPsourceporz:sailceir iridilonports 3soo73.750530210.42.105-U12255.255-255.255UDPsourcepen:3601Destlnaiionporr: 300S3. M 5743210.42.105.143255-255.255.255UDPsourceport:364)1Des ti nationport:揚。_94-747665?10,4?,10=),143?55.55.

16、，5.小1UDP50urceport :MCIdestinationpart: 3600rrirtts i fioo b/tes on ire, 1QQ byres caprurec)Ark矽 Time: Apr 24, 2M.4 18；$2:d?. 551753666t鈿# tfelri fran previous pa我制：1.47380000 mecghrime since reference or first frame: 1.638655ODD secondsFram& Number: 3Packet Length: 100 bytescaptLjr& Lengih: 100 byr

17、esProtocols in frame: eth:ip:口即：dataEih&rri&E tip src： :aB6h:60:ed：d9 (ec dS:6b：ea：df DST： 01：00：5：0d:05 :D2 01：OO：5-OOiO5：OJ)DSST1 fiat Ion： O1JOO：5：OO：O52O2 (01:00! 55! 00! OS ：t2)Source: c:aB:6b:6Sidd9 (ec:afi:6b:.6S:ed:d9i)type： ip (oxoboo)Internet ProtocoL 5rc: 210-42.105.146 (210.42.105.146)r

18、Dst: 229.0.5.2 (229.0.5.2)Version: 4Header length: 20 bytesLH DlfferertLldied services Flld: 0 x00 (dscp 0 x00： Defaulr; ecn* OxOO)Total Lengths S6identification: 0 x4f2c (20268)田 Flags: DxDOFragment offset: 0Tlm live: i2Protocol: UDP (0 x11)Ltd Header checksum: 0 x25ic corr&ccSource: 210.42.105.146

19、 (210.42,105.146)Destlnation: 229.0. k2 (22?. 0. 5.2)i jt一 Aus x n k ma HB| a a 4 -fi3*日三i8.8! fX J* V 八弓、分析：發(fā)送組廣播日勺結(jié)點如圖所示，高層合同大部分為UDP,少數(shù)為IGMP或OSPF。4.捕獲局域網(wǎng)上日勺所有icmp包，Ethereal日勺capture filter日勺filter string設(shè)立為：icmp (1).在主機(jī).53上ping局域網(wǎng)上日勺另一主機(jī)(例如)。眼口廠175.4 3.103.*10-42.105-189-ICMPtjesrTiriarTorTunreach

20、abtPorrnr ea chab1e)1 J.-12.13ICMPEkn at t OHei-hib eCH05Tir ea Ha h 1 e.)(2).觀測并分析主機(jī).53發(fā)出或接受日勺所有icmp包，及icmp包日勺類型和構(gòu)造。 Fr-artie 1 (70 byT Oft7QArrival Tlrfl*： Apr 24F 2014547101000Time del ta from previous packet: D. OOOOODDOO secondsTime since reference or first frame: OODDOCMJCICI secondsFrarrie Ni

21、mber e 1packer Lengrh !： 70 byresICpxure Length: 7Q byrespro15 in frartai&i -5 drttfS： Ipimtfp Ethernet II, Src OOzla ; 6d ; 0?(00;la ;6d, Dst ; 210,42,105.13 (ec; aB;b ;67; 35oestl mat Ion: 210.42.105.1S9 fee： 67:35 5) Source r 00 ;la 02 F5s46 COO ;la; &d;O2 sf 9 =4 6) Typet IP (0 x0800B internex P

22、rOTOCOl+ Srcs 1753133403 (175.5.13333 DSt : 210.42.105.155 210-4 2.105139) version l 4langth; 20 btts曰 ClffrHTiaT*Cl 5tr-MliC*50 x00(D5CP 0 x00： D0 00. Dierenfi ated Services Codepoirrt:; Oefau 11.0. . tewcapable Transport (ect： 0 0 - ECN-CE： 0 Tcrcal Length: 56I deinrifl cat i anz 口婦(14 fmzl) Flags

23、 !： 0 x00O-Rt erved bit; Not.0. Dont f: not s,.O. Mgr e fragmerrts ; Not setFragment offseti 0Time to live: 111Prcrcocol s ICMP fOxQlO Header checksum; 0 x6fd3 correcioocid: TrueBad : Fal&esource: 175.33.133.93 C175.43.183.83)Oest-SnatHon; 210.42.105.1S5 之:im?1.LCfS.B lerne： control Message ProtocolType： J (；De5t1nat1on unreachableI Code: 3 (Port unreachable)checksum: OsSeel correct分析:Internet ProtocolT Src: 21O.42.1C5.189 C210.42,1O5.189X Dst: 175.3.183.83 C175.45.183.33) T/or c i nn 00103&39 3