Description

Computer Networks

This part is aimed to make you familiar with basic networking tools. Read the man pages of the
tools ifconfig (ipconfig), ping, traceroute (tracert), and nslookup.
1. Find the IP address of your machine. Try connecting to different service providers and
notice the changes, if any, in the IP address of your machine.
2. Find the IP address associated with www.google.com and www.facebook.com using
nslookup. Change the DNS server (look for open DNS servers on the web) to use in the
command and see how IP address of the above domains change.

3. Ping the IP address of www.google.com .Send the ping packets with different packet
sizes, TTL values, etc.
4. Run traceroute via two or more service providers for www.iitd.ac.in. If your ISP blocks
packets on the path to www.iitd.ac.in then try with a different destination like
www.google.com, or www.facebook.com, etc. Report your observations, like if some
paths default to IPv6 then how you can force traceroute to use IPv4, any private IP
addresses(10.*.*.* or 192.168.*.*), routers that do not reply to requests, etc. What
changes can you make to the traceroute request for some of the missing routers to
reply?

Report your observations in the submission PDF along with the appropriate screenshots.

Packet Analysis

This part of the assignment is to make you familiar with the packet analyzer tool, Wireshark.
Wireshark is free and open-source. It is used for network troubleshooting, analysis, software
and communications protocol development, and education.

1. DNS Task

Use wireshark to grab all packets on your wireless interface, while visiting the website
http://www.cse.iitd.ac.in from your browser. Do an ipconfig /flushdns1 before you do this activity
to clear your local DNS cache. Report the following:
1. Locate the DNS query and response messages. Are then sent over UDP or TCP?
2. How many DNS queries are sent from your browser (host machine) to DNS Server(s)?
3. How many DNS servers are involved?
4. Which DNS Server replies with actual IP Address(es).
5. Do all DNS servers respond?
6. Clearly list the resource records involved in resolving the IP address of the site,
mentioning, Name, value, type, TTL appropriately in the complete resolving process of
this DNS conversation including query/queries and response/answer(s).
Provide appropriate screenshot from terminal and wireshark to answer the above questions in
your report.

2. Iperf Task

● Start the Wireshark packet sniffer and start capturing.
● Open a terminal
● Start iperf3 in client with reverse mode destined to ping.online.net as
iperf3 -u -t 10 -c ping.online.net -p 5208 -R
● Once the iperf3 communication is complete stop the Wireshark packet capture
Answer the following questions:
1. How many UDP packets are exchanged in this communication between iperf3 client and
remote server?
2. Who is sending bulk data to whom? What is the average size of the packet sent?
3. Calculate the throughput (bytes transferred per unit time) for this UDP conversation
using UDP’s length field. Explain how you calculated this value using Wireshark capture
in this experiment along with relevant screenshots. Verify your calculation with the one
done by Wireshark using “Capture File properties” as well with the one displayed by
iperf3 terminal. If you observe the major difference in your calculation and with the other
two listed here, comment why and how?
In the saved file used for analysis, export only those IP packets involved in either direction (in
communication) using appropriate Wireshark display filters and save it to another file to upload
during submission.

3. HTTP Task

Analyse the attached HTTP/2 packet (http2-h2c.pcap) capture using Wireshark to answer the
following (Hint : Use Statistics->HTTP, HTTP2 windows).
1. How many HTTP/2 and HTTP/1.1 packets are present?
2. How many HTTP/2 packets are exchanged between client and server here before the
first object is fetched?
3. What main difference do you observe in headers of HTTP/2 packets displayed here,
compared to the headers of HTTP/1.1 packets ?

4. PING Task

● Start the Wireshark packet sniffer and start capturing.
● Open a terminal. Execute ping -s 3500 ping-ams1.online.net -c 5
● Stop the wireshark capture and save the file for further analysis.
Answer the following questions:
1. How many total IP packets are exchanged in the communication between your host and
the remote server representing ping-ams1.online.net ?
2. What is the size of each ping request sent from your host to remote server?
3. Make a table for each ping request packet sent from your host to remote, the respective
field indicating it, if the request packet is fragmented or not. If packet is fragmented ( add
details on number of IP fragments and on each fragment), Time of sending each
individual fragment/packet, length of the individual fragment/packet), time of receiving
ping response, the respective field indicating if response packet is fragmented or not, if
response packet is fragmented, include the number of IP fragments, total actual length of
data carried by the respective fragment in respective ping request and response.
In the saved file used for analysis, export only those IP packets involved in either direction (in
communication) using appropriate Wireshark display filters and save it to another file to upload
during submission.

5. TRACEROUTE Task

● You will require traceroute software to execute this experiment.
● Start the Wireshark packet sniffer and start capturing. Open a terminal.
● Execute traceroute -q 5 ping-ams1.online.net 3500.
● Stop the wireshark capture and save the file for further analysis.
Answer the following questions:
1. How many hops are involved in finding the route to this ping-ams1.online.net
2. How many total IP packets are exchanged in the communication to get the final
traceroute output of ping-ams1.online.net? How many of them are sent from client to
remote machine (server/router) ? How many of them are sent from the remote machine
(hop/server/router) to the local client ? Tabulate this with an entry for a router/server and
the client too.
3. Which fields in the IP datagram always change from one datagram to the next within this
series of IP packets sent by your host/client ? Which fields stay constant? Which of the
fields must stay constant? Which fields must change? Why?
In the saved file used for analysis, export only those IP packets involved in either direction (in
communication) using appropriate Wireshark display filters and save it to another file to upload
during submission.

SUBMISSION INSTRUCTIONS

Prepare a detailed observation and analysis report, and the appropriate screenshots from the
wireshark and terminal for listed questions with specific details asked in individual tasks along
with respective wireshark trace files (for what is being mentioned only in the IPERF TASK, PING
TASK and TRACEROUTE TASK; Please don’t upload the entire trace file captured). Submit
your report in PDF format with name as .pdf. Submit your wireshark traces
named as _iperf.pcap, _ping.pcap and _traceroute.pcap .
Zip all these files into a single zip file .zip and submit on moodle.