Wireshark6-Ethernet-ARP

利用Wireshark分析Ethernet_ARP协议

重 庆 大 学 软 件 学 院

实 验 报 告

实验名称 课程名称

利用Wireshark分析Ethernet_ARP协议

计算机网络与通信

姓名 学号 班级

成绩

教师 胡海波

日期 20XX-05-18

第 0 页 共 12 页

《计算机网络与通信》实验报告

开课实验室： 年 月 日 姓 名 年级、班级 成 绩 指导教师 胡海波 实验（项目）名称 实验六：利用Wireshark分析Ethernet_ARP协议 教师评语 一、实验目的

1.学会怎么使用nslookup工具查询并分析Internet域名信息或诊断DNS服务器，并且能够使用ipconfig工具进行分析。

2.了解怎么使用WireShark简单分析DNS协议。 二、使用的软件、硬件 1. 接入Internet的计算机 2.抓包工具WireShark 3.wingdows 7 自带的截图工具

三、实验过程原始记录(数据、图表、计算等)

教师签名：胡海波 年 月 日 1. What is the 48-bit Ethernet address of your computer?

The Ethernet address of my computer The 48-bit Ethernet address of my computer is:c8:0a:a9:db:9b:f3

第 1 页 共 12 页

2. What is the 48-bit destination address in the Ethernet frame? Is this the Ethernet address of gaia.cs.umass.edu? (Hint: the answer is no). What device has this as its Ethernet address? [Note: this is an important question, and one that students sometimes get wrong. Re-read pages 468-469 in the text and make sure you understand the answer here.]

(1) The 48-bit destination address in the Ethernet frame is:00:23:89:8d:50:71

The destination address in the Ethernet frame (2) This is not the Ethernet address of gaia.cs.umass.edu.

(3)It is the address of my Linksys router, whick is the link used to get off the subnet. 3. Give the hexadecimal value for the two-byte Frame type field. What do the bit(s) whose value is 1 mean within the flag field?

(1)The hexadecimal value for the two-byte Frame type field is:ox0800

The hexadecimal value for the two-byte Frame type field (2)The value is 1 within the flag field means the fragment has not been fragmented.

第 2 页 共 12 页

Flag 4. How many bytes from the very start of the Ethernet frame does the ASCII “G” in “GET” appear in the Ethernet frame?

(1)The ASCII “G” appears 54 bytes from the very start of the Ethernet frame. (2)Calculation process as follows:

There are 14 bytes of Ethernet frame,20 bytes of IP header and 20 bytes of TCP header before HTTP data is encountered.

5. What is the hexadecimal value of the CRC field in this Ethernet frame? (1)There is no CRC field.

(2)Because the CRC calculated before the Wireshark packet sniffer start up.

No CRC

第 3 页 共 12 页

6. What is the value of the Ethernet source address? Is this the address of your computer, or of gaia.cs.umass.edu (Hint: the answer is no). What device has this as its Ethernet address?

(1) The value of the Ethernet source address is: 00:23:89:8d:50:71

HTTP response message (2)This is neither the address of your computer,northe address of gaia.cs.umass.edu. (3)It is the address of my Linksys router,which is the link used to get onto my subnet.

7. What is the destination address in the Ethernet frame? Is this the Ethernet address of your computer?

(1) The destination address in the Ethernet frame is:c8:0a:a9:db:9b:f3 (2) It is the address of my computer.

(The 48-bit Ethernet address of my computer is:c8:0a:a9:db:9b:f3)

8. Give the hexadecimal value for the two-byte Frame type field. What do the bit(s) whose value is 1 mean within the flag field?

(1) The hexadecimal value for the two-byte Frame type field is: 0x0800.

第 4 页 共 12 页