Reference no: EM132732546

ITECH1102 Networking and Security - Federation University

Week 6 lab sheet: The Transport layer.

Major goals of this lab sheet:
• Capture and investigate Transport layer protocols
• Investigate the Linux file system and basic Linux commands

Part 1 - Investigate simple HTTP. Discussion:
Simple network interactions can be analysed using Wireshark.

Two simple Wireshark HTTP interactions are available on Moodle (Topic 6 section).
• Capture 1 - Browser request for a simple HTML page
• Capture 2 - Similar request, but it includes two images in the HTML page

Although we can capture the traffic ourselves, in the first instance use the captures on Moodle so that all discussion of the traffic aligns exactly with the discussion in this lab sheet.

Upon completion of part 1 of the lab sheet, you may like to capture each HTTP interaction live. (This is optional)

Task 1: Download the first capture file from Moodle and open it in Wireshark.
Then observe the Wireshark display while reading the following description.

The filename is Phoebe-HelloITECH1102.pcapng
This capture contains the 10 packets of a simple HTTP GET from a server named phoebe.

• The first 3 packets are the 3-way handshake setting up the connection between the browser client (Firefox) and the webserver (phoebe). [note the SYN, SYN/ACK, ACK flags.]

• Packet 4 is an HTTP request from the Web Browser, asking for a specific HTML page.

• Packet 5 is an acknowledgement from the Server to the Client. This packet acknowledges that the Server successfully received 389 bytes from the Web Client.

• Packet 6 is the Server sending the requested HTML page back to the Web Client.

• Packets 7 & 8 are the Server closing its connection with the Client.

• Packets 9 & 10 are the Client closing its connection with the Server.

Task 2: understand the difference between Relative and Actual Seq/Ack numbers.

If you look at the first packet, you will see in the packet list pane that the sequence number is zero (seq = 0).

Further down in the Wireshark display, you will see larger sequence and acknowledgement numbers (390, 374 etc.). These are Relative sequence and acknowledgement numbers. They are relative to the initial sequence numbers setup during the TCP connection (3-way handshake).
To view the actual values, we are going to change the associated preference in Wireshark. From the Edit Menu
Edit > Preferences > Protocols > TCP Uncheck Relative Sequence Numbers

You are now seeing actual sequence and acknowledgement numbers as opposed to relative ones.

You should now be able to see that the initial sequence number (ISN) from the Client to the Server is 1043872907 and that the initial sequence number (ISN) from the Server to the Client is 3447850100.

Notice that the initial sequence number for the connection between the Client and Server is totally different to that from the opposite connection (Server to Client). This is less obvious when using Relative sequence numbers.

Note - You can view both

If you open a capture twice, you can set the associated preferences so that one shows actual sequence numbers and the other relative numbers.
This could be useful on occasions.

Task 3: How the HTTP protocol works.

The HTTP protocol is a very simple text-based protocol developed by Tim Berners-Lee when he was creating what is now called the World Wide Web.

Do an Internet search to understand more about the HTTP protocol.

You should spend 5 to 10 minutes researching HTTP so that you are a little more familiar with how the protocol works.

Task 4: Investigate Port Numbers

The port numbers used by the Client and Server can be seen in the packet list pane or the packet decode pane of Wireshark.

What is the port number used by the Client? ........................................

What is the port number used by the Server? ........................................

Are these port numbers consistent with those described in the Topic 6 lecture? What are the associated sockets of the Client and Server?
Server socket .........................................................

Client socket .........................................................

Task 5: Investigate TCP Flags

The Packet Decode pane shows all aspects of the TCP header.

The Flags indicate the main function of each TCP Segment (as shown below)

Notice that the Flags are either On or Off (0 or 1) and hence only take up one bit each.

Choose a few packets of the capture. Note the state of the flags and how it relates to the display in the packet list pane.

Task 6: Following sequence and acknowledgement numbers of the Client, then the Server.

The screen capture below shows the 5 client packets first then it shows the 5 server packets.

From this capture, we should be able to see the following:
• The initial Relative Sequence Number is zero.
• After it is acknowledged, it becomes 1.
• After sending 389 bytes, it increases to 390

Try doing a similar analysis of the traffic coming from the last 5 packets that is the traffic from the Server to the Client.

Note - You may like to also try this using actual sequence numbers instead of Relative ones.

Task 7: Download the second capture from Moodle (Phoebe-Hello_Images.pcapng ) and analyse it.

You should spend at least 15 minutes trying to discover what is happening in this Wireshark capture. You may need to refer to the Internet if you are unsure about particular traffic.

This capture is similar to that of above-downloaded one. However, in this case, two images are also being downloaded as part of the web page. Hence far more traffic is generated.

Write down any findings so you can describe what is happening to your tutor.

Part 2 - Using wildcards in Linux copy (cp) move (mv) and remove (rm) commands.

The Linux shell and shell commands.

When we run a terminal from the taskbar, we are running a program called the Linux shell (equivalent to the command line in Windows).
The default shell in Linux Lite is the bash shell (or Bourne again shell). The shell allows Linux users to administer the Linux system by entering Linux commands and creating and running scripts.

The bash shell interprets commands we enter and displays the results to the screen. Most commands require arguments that often include paths to files or directories.
To specify a directory, it is good practice to use a forward slash at the end of the directory reference to indicate it is a directory.
Example: /home/user2/MyGames/

To specify a file, you use a directory reference followed by the filename.
Example: /home/user2/MyGames/game1.exe

Last week we saw how we could use a dot ( . ) and dot dot ( .. ) to represent the current directory and the directory one level up. We also saw that the tilde character (~) could be used to represent the current user's home directory.

This week we want to extend the treatment of commands that are run in a Linux shell (shell commands) to include the wildcards? and *. Wildcards are often used in shell commands to

Wildcards are used in a file reference to specify multiple files. A question mark in a file reference indicates any single character in place of the question mark.

Hence file? Would specify any of the following filenames: file1, file2, file4, fileC etc. An asterisk in a file reference can represent any number of characters (zero or more).
Hence file* Would specify any of the following filenames: file, file123, fileAbc etc.

Wildcards are particularly useful when looking for multiple files in an ls (list) command, or for copying multiple files from one place in the Linux file system to another.

Absolute and Relative file references

There are two categories of file system reference in Linux. Absolute file references fully specify every directory from the root of the file system to the file (or files) in question.

Hence Absolute file references always start with a forward slash /

Examples:
/home/user1/file1
/home/user1/
/home/user1/*
/home/user1/file2??.conf

Relative file references are file references that are relative to the Current Working Directory
as displayed in the pwd command.

Relative file references never start with a forward slash.
Examples:
file1
../dir2/file
.
..
~/vault/

Exercises using the copy and move commands

To start with, we need to create a directory that contains numerous files. To create directories in linux, do the following set of commands one after the other.
cd /
sudo mkdir fileStore cd fileStore
sudo mkdir oldSongs cd oldSongs
sudo touch song11 sudo touch song12 sudo touch song13 sudo touch song45 sudo touch song55 sudo touch song65

You should have a directory /fileStore/oldSongs/ that contains 6 files.

Now create a directory under /home/user1 named songBackup using the mkdir command.

Copy command

The format of the copy (and move) command is:

cp source destination

Where source and destination are file references Use bash shell commands to complete the following exercises.
1. Using absolute addresses for both source and destination copy song11 to songBackup/
2. Using absolute addresses copy song11, song12 and song13 to songBackup
3. Using absolute addresses copy any song that ends in 5 to songBackup
4. Delete all files in the songBackup directory with the rm commands and the wildcard *
5. Now repeat the first 3 exercises using relative addressing for both the source and destination.

Testing yourself

Being able to use shell commands to list, copy, delete and move files is an important skill. Using either absolute or relative file references is also an important skill.
To test your skills, try the following:

1. Use the ls command to list multiple files from within Linux directories.

Example change directory to /bin
List all files that start with the letter c List all three letter files that start with c
Determine how many files start with ch (the answer is 5)

2. You could also test yourself by copying single or multiple files from any location in the Linux file system to your home directory.

Try to make sure you understand all of the following:
• Absolute addressing
• Relative addressing
• Using . .. ~ ? *
• Understand how to use cp mv rm mkdir ls touch

Attachment:- Transport Layer.rar