实验5 分析IP报文结构.docx

上传人：小飞机

文档编号：5174923

上传时间：2023-06-11

格式：DOCX

页数：4

大小：140.12KB

《实验5 分析IP报文结构.docx》由会员分享，可在线阅读，更多相关《实验5 分析IP报文结构.docx（4页珍藏版）》请在三一办公上搜索。

1、实验5分析IP报文结构1. 实验目的1）深入理解ip报文结构和工作原理；2）掌握用Wireshark分析俘获的踪迹文件的基本技能。2. 实验环境1）PC 一台；2）具有以太网卡一块，通过双绞线与校园网相连，或者具有适合的踪迹文件;3）每台PC运行程序协议分析仪Wiresharko3. 实验步骤1）分析俘获的分组打开踪迹文件，对其源地址进行选择根据源地址作为过滤条件，获得与192.168.1.113相关的分组Capturing from liUc网 Wireshark 1.12.4 (vl. 12.4-0-gb4861 da from master-1.12)File Edit View Go

2、Capture Analyze Statistics Telephony Tools Internals Help AI X 0 I Q印昴业I回良|园顷殴回|娜图陋溢I攻Filter: ip.dst = 1178.147.50v Expression. Clear Apply Protocol Length InfoSaveANo.TimeSourceDestination58244.65522000 192.168.1.113117.2S.147. 50UDP1171 sourceport: 7273 Destination port: 727358254.66879300 117. 28

3、.147. 50192.168.1.113UDP142 Sourceport: 7273 Destination port: 727358264.66906200 192.168.1.113117.28.147. 50UDP1171 sourceport: 7273 Destlnation port: 727358274.66966000 117. 28.147. 50192.168.1.113UDP142 Sourceport: 7273 Destination port: 727358284.66993600 192.168.1.113117.28.147. 50UDP1171 sourc

4、eport: 7273 Destination port: 727358294.67053000 117. 28.147. 50192.168.1.113udp142 sourceport: 7273 Destlnation port: 727358304.67078400192.168.1.113117.28.147. 50UDP1171 sourceport: 7273 Desfi nation port: 727358314.67145400 117.28.147. 50192.168.1.113UDP142 Sourceport: 7273 Destination port: 7273

5、58324.67145600 117. 28.147. 50192.16S.1.113udp142 sourceport: 7273 Destlnation port: 727358334.67145600 117. 28.147. 50192.168.1.113UDP142 Sourceport: 7273 Destination port: 727358344.67169500192.168.1.113117.28.147. 50UDP1171 sourceport: 7273 Destination port: 727358354.67176900 192.168.1.113117.28

6、.147. 50UDP1171 sourceport: 7273 Destination port: 727358364.67182500192.168.1.113117.28.147. 50UDP1171 sourceport: 7273 Destination port: 727358374.67231500 117. 28.147. 50192.168.1.113UDP142 Sourceport: 7273 Destlnation port: 727358384.67231600 117. 28.147. 50192.16S.1.113UDP142 Sourceport: 7273 D

7、esfi nation port: 727358394.67249400 192.168.1.113117.28.147.50UDP1171 sourceport: 7273 Destination port: 727358404.67256100 192.168.1.113117.28.147. 50udp1171 sourceport: 7273 Destlnation port: 727358414.67660300 117. 28.147. 50192.168.1.113UDP142 Sourceport: 7273 Desfi nation port: 727358424.67681

8、800192.168.1.113117.28.147. 50UDP1171 sourceport: 7273 Destination port: 727358434.67739900 117. 28.147. 50192.16S.1.113udp142 sourceport: 7273 Destlnation port: 727358444.67761000 192.168.1.113117.28.147. 50UDP1171 sourceport: 7273 Desfi nation port: 7273KQA rza col 1 cunn i m -i cd -i i i r r r nu

9、 r.r i aqo*inr0 Frame5835: 1171 bytes on wire (9368 bits), 1171bytes captured (9368 bits) on interface 00 Ethernet II, src: Compalln_40:68f7 (f8:a9:63:40:68:f7), Dst: Tp-LinkT_ca:30:a0 (e4:d3:32:ca:30:a0)El internet protocol version 4, src192.168.1.113(192.168.1.113), DST： 117.2S.147.50 (117.28.147.

10、50)0 userDatagram Protocol , 5rc Port7273 (7273), Dst Port: 7273 (7273)田 Data(1129 bytes)0000e4d332ca 30a0 f8a963 4068 f70800 4500.2.0.ch. E.001004853423 0000 801100 00cO aS0171 751c.4#.qu.002093321c69 1c69 0471ce ea91 6c50d2 5561,2.1.i . q.lp.ua00304tc70020 0005 000000 0000 000000 c74t0000406155354

11、f 3700 000004 490a 270802 1085aU5O7.cc u cc cCJ ccrr T C4 cA rt tz -Fezf- c. T rlAhC/l-|TA, 囱|以太网：live capture in progress File: .Packets: 272102 - Displayed: 272102 (100.0%)Profile: Default_i-，-1有时为了清晰起见，屏蔽掉高层协议的细节，可以点击“ Analyze Enable Protocols ”打开 “Profile:Default”窗口，若去除选择IP，则屏蔽IP相关的信息。AWireshark

12、: Enabled Protocols - Profile: Default_ nEnabled ProtocolsStatus 4Protocol De&cri ptionA0DTCP-IPDigital Transmission Content Protection over IP回DTLSDatagram Transport Layer Security0DTPDynamic Trunk Protocol0DTPTDeskTop PassThrough Protocol0DTSPROVIDERDCE Distributed Time Service Provider0DTSSTIME_R

13、EQDCE Distributed Time Seirvice Local Server0DUADPNSS/DASS2- U ser Adsptatio-n Layer0DVB-CIDVB Common Interface0DVB - DATA MPEDVB DATA Multi Protocol EncapsulationDVB-S2DVB-S2 Modeadaption Header回DVB-S2-BBDVB-S2 Baseband Frame0DVB-S-GSEDVE-S2 GSE Packet0DVB AITDVB Application Information Table0DVB B

14、ATDVB Bouquet Association Table0DVB EITDVB Event Information Table回DVB NITDVB Network Information TableDisabling a protocol prevents higher layer protocols from being displayedEnable AllDisable AllInvertHelpQKApplySaveCancel1）分析IP报文结构将计算机连入网络，打开Wireshark俘获分组，从本机向选定的Web服务器发送Ping 报文。选定其中一条Ping报文，该帧中的协

15、议结构是：Ethernet IP:ICMP:data0为了进一步分析IP数据报结构，点击首部细节信息栏中的“Internet Protocol行，有关信息展开如下。O.TimeSourceDestinationProtocolLengthInfo58304.67078400 192.168.1.113117.28.147.50UDP1171sourceport7273Destinationport727358314.67145400 117.28.147. 50192.168.1.113UDP142Sourceport7273Destinationport727358324.67145600

16、 117.28.147. 50192.168.1.113UDP142Sourceport7273Destinationport727358334.6714 5600 117.28.147. 50192.168.1.113UDP142sourceport7273Destinationport727358344.67169500 192.168.1.113117.28.147.50UDP1171Sourceport7273Destinationport727358354.67176900 192.168.1.113117.28.147.50UDP1171Sourceport:7273Destina

17、tionport:727358364.67182 500 192.168.1.113117.28.147. 50UDP1171sourceport7273Destinationport727358374.67231500 117.28.147. 50192.168.1.113UDP142Sourceport7273Destinationport727358384.67231600 117.28.147. 50192.168.1.113UDP142Sourceport7273Destinationport727358394.67249400 192.168.1.113117.28.147. 50

18、UDP1171sourceport7273Destinationport727358404.67256100 192.168.1.113117.28.147.50UDP1171Sourceport7273Destinationport727358414.67660300 117.28.147. 50192.168.1.113UDP142Sourceport7273Destinationport727358424.67681800 192.168.1.113117.28.147. 50UDP1171sourceport7273Destinationport7273E) Source: Compa

19、lin_40:68:f7 (f8:a9:63:40:68:f7)Type: ip (0x0800)Internet Protocol Version 4, Src: 192.168.1.113 (192.168.1.113), Dst: 117.28.147.50 (117.28.147.50) version: 4 Header Length: 20 bytes田 Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport) Total Lengt

20、h: 1157 Identification: 0x3423 (13347)S Flags: 0x00Fragment offset: 0Time to live: 128Protocol: udp (17)E) Header checksum: 0x0000 validarion disabled source： 192.168.1.113 (192.168.1.113) Destination: 117.28.147.50 (117.28.147.50) source GeoiP： unknown Destination GeoiP: unknown回答下列问题：1）你使用的计算机的IP地

21、址是多少?答：192.168.1.113raw命翎朝Microsoft Windows 版卒 6.3.9600 2013 Microsoft Corporation .：.保,留所有权利口:XUsers Xflmyipconf igin do us IP 配置以太网适配器Bluetooth网络连接:媒体已断开线局域网适配器本地连接花1：定碎天si掩网赛U4网认连本IP子默SN 6 - DUP - 的I止 , -1 - - -线局域网适配器WLAN程室术青口:媒体已断开建浅特7E的DNS后缀: 以太网适配器以太网:fe80：d092：4739：9b9b：7fa3x4192.168.1.113

22、255.255.255.0192.168.1.1媒体已断开s J N 6 a D u J-p a af援行电槌网接U6地认连IP本默后啜通止:2001：0：5e5：79fb：2088：c0el：91ca：aba9 fe80：2088：c0el：91ca：a6a9xll3：Un 4：1/10:定的DNS后缀隧道适配器 is at ap. :暨室赤查Z=媒体已断开差;麦特正的DNS后缀: 隧道适配器 Teredo Tunneling Pseudo-Interface:2）在IP数据报首部，较高层协议字段中的值是什么？答：173）IP首部有多少字节？载荷字段有多少字节？答：20 754）该IP数据报分段啦没有？如何判断？答：没有，片偏移为0.5）关于高层协议有哪些有用信息？答：我们可以看到正在做什么，是请求还是回应，还是在传递信息。