49202: Communication Protocols

Laboratory Notes: Laboratory 6

Dr. Daniel R. Franklin

April 12, 2021

April 12, 2021 Laboratory Notes - 49202- Communication Protocols 1

CONTENTS CONTENTS

Contents

1 Introduction 2

2 Pre-Lab Work 2

3 Setup 3

4 Laboratory Tasks 3

April 12, 2021 Laboratory Notes - 49202- Communication Protocols 1

 2 PRE-LAB WORK

1 Introduction
This laboratory covers content from Module 6, with elements of some of the other Modules included
as well. The main aims of this laboratory are to:
1. Become familiar with the concept of packet sniffing using Wireshark - this is important because
you will be relying on Wireshark for other labs later in the semester;
2. Visualise protocol data units (PDUs) encapsulated within protocols and be able to identify vari-
ous elements of specific protocols - in particular, to identify major protocols used in the TCP/IP
protocol suite and in switched Ethernet;
3. Become familiar with the type of frames that typically exist on a local area network based on
Ethernet, and the frequency with which they occur;
4. To clarify & enhance your understanding of the IP concepts covered in earlier Modules, specif-
ically:
• IP Addressing concepts
• Packet Forwarding concepts
• ARP operation
• Packet MTU size and fragmentation concepts

2 Pre-Lab Work
Before attempting the laboratory, you should complete the following pre-lab questions. This will
greatly improve your understanding of what is happening in the laboratory.
1. A host with an IP address of [Link]/24 is connected to a network which has a router
with a single interface connected to that network with an IP address of [Link]/24. Can
the host ping the router? Why or why not?
2. An IP packet is sent from a host with a source address of [Link]/24 to a destination
address of [Link] over the network shown in Figure 1. How does the host know what
destination MAC address to use for the layer 2 frame that is sent over segment A?
3. What are the source and destination MAC addresses that are used for the frames sent over the
3 segments A, B and C?
4. What are the source and destination IP addresses that are used for the datagrams sent over the
3 segments A, B and C ?
5. What would happen if the host tried to ping the destination with the TTL set to 1?
6. An IP datagram with a total size of 4000 bytes is sent over an Ethernet network which has a
MTU of 1500 bytes. What happens?
7. An IP datagram with a total size of 4000 bytes is sent over an Ethernet network which has a
MTU of 1500 bytes. The “don’t fragment” bit in the IP header is set. What happens?

April 12, 2021 Laboratory Notes - 49202- Communication Protocols 2

 4 LABORATORY TASKS

Figure 1: Pre-lab network topology.

3 Setup
Prior to starting the lab, start your virtual machine (refer to Lab 1 notes) and make sure you have the
latest version of the lab scripts:

cd ˜/comm-protocols-labs
git pull
For this lab, we will be using a generic OSPF-based network topology with full Internet access, as
shown in Figure 2.
To start the Mininet emulated network, enter the folder ˜/comm-protocols-labs/ospf ring
if you haven’t already done so, and run the command

sudo ../[Link]

4 Laboratory Tasks
1. Select a router and a specific interface in the core of the network. Open an xterm on that router
and identify the MAC (Layer 2) address of the interface - you can do this using either of the
two commands:
ip link
ifconfig
If you use ip link, the MAC address will be listed under link/ether field; if you use
ifconfig, it will be in the ether field.

April 12, 2021 Laboratory Notes - 49202- Communication Protocols 3

 4 LABORATORY TASKS

Internet
h1 h2
h1-eth0 h2-eth0
enp0s3 [Link]
r9-eth1 [Link]
[Link]

r9 (NAT) r1-eth3
r1- r2-eth3
e
10. th5 [Link] r2 [Link]
1.9 r1-eth1 r2-eth1
.1
[Link] [Link]
r2
th .1r1 10 -eth
2 r3
r1- 1.5.1

2
th .8 -e .2 2 10 -eth
10

r1 .1.8 .3
eth

-e .2 .2 1
r8 .8.1
.

10 .3
4

0 .3
h8-eth0 1 h3-eth0
h8 [Link] r8 r3 h3
r8-eth3 r3-eth3 [Link]
[Link] r8-eth1 r3-eth2 [Link]
[Link] [Link]
r7-eth2 r4-eth1
r7-eth3 [Link] [Link] r4-eth3
[Link]
[Link] r7 r4
h7-eth0 r7 h4-eth0
r5- 5.1.5

2
10 -eth r6 th .4 [Link]
10
eth

[Link] .6 1 10 -eth 1
th .5 -e
r4 .4.5
.

.7 -e
4

.6 2
.7 .7
.6 r5 .4.5 10
10
r6-eth1 r5-eth2
h7 [Link] [Link] h4
r6 r6-eth3 r5 r5-eth3
[Link]
[Link]

h6-eth0 h5-eth0
[Link] [Link]

h6 h5

Figure 2: Network topology for Lab 6. The routing protocol is OSPF.

April 12, 2021 Laboratory Notes - 49202- Communication Protocols 4

 4 LABORATORY TASKS

2. Start Wireshark on your chosen router and interface. Randomly acquire some frames and iden-
tify the protocols within them.
3. Can you identify the source and destination of the frames? What type of frames are they? Are
they all Ethernet II or are there some 802.3 frames as well? You can generate some additional
traffic to analyse using ping or iperf3 if you wish.
4. Open a web browser (remember: you’ll need to run it via sudo -u mininet firefox)
on the router and enter the URL of a host that would be reachable via your chosen interface (for
example, on R1, capturing on r1-eth1, try to browse the URL [Link] Capture the
packets that are sent to the server and the first few response packets.
(a) Identify the protocols at each layer (you can’t see the physical layer in Wireshark, but you
should be able to identify the data link, network, transport and application layer protocols).
(b) What is the response time of the server? How did you calculate this?
(c) Calculate the protocol overhead for the upstream GET request.
(d) Can you see all of the fields within the Ethernet frame protocol? What are the values of
the fields?
5. On any host in the network (e.g. h3, open and xterm and start Wireshark on the sole interface
(h3-eth0 in this case). At the xterm, type the command nslookup [Link] (or substi-
tute another well-known domain name). Capture the request and response using Wireshark.
(a) What protocols are being used here?
(b) What transport layer protocol is being used? Comment on why you think the DNS lookup
is using this transport layer protocol.
(c) What is the response time for this request?
(d) Calculate the protocol overhead
6. Type the command ping [Link] and capture the results with Wireshark.
(a) What are the types of protocols within the frames that you see?
(b) What protocols are being used here?
(c) What transport layer protocol is being used? Why?
(d) What is the response time of the host being pinged?
(e) Calculate the protocol overhead
7. Characterise the background traffic on the network. Run Wireshark one one of the routers for 5
minutes continuously without touching the keyboard. Ensure that you do not have a network
application (e.g. the web browser) running. Observe and record the frames that you see
on the network, including their origin and destination, protocol type and frequency (rate of
occurrence). What conclusions can you draw from this?
Verify that you can ping other routers or hosts in the network before continuing.
8. Ping an external web server from your host by typing:

April 12, 2021 Laboratory Notes - 49202- Communication Protocols 5

 4 LABORATORY TASKS

ping -c 5 [Link]
This may not work if you are doing the lab on campus - in this case, try pinging [Link]
Examine the contents of your ARP cache:

arp -n
Record your results (if you omit the -n flag, you will see the domain name of any resolvable
host - this can slow things down if some are not resolvable, although it should work in our
simulated network).
• What is the MAC address of your local router?
• What does the local router do with the Ethernet frame that is delivered from your PC
bound for the web server?
• Why is there no MAC address for the web server in the ARP cache?
• Explain the entire sequence of events that are required to deliver an ICMP payload from
your computer to the web server. In particular, your answer needs to demonstrate under-
standing of precisely how IP packets are carried over Ethernet from their source to their
destination.
9. From a host node, ping its default gateway (e.g. from h3 we can ping r3):

ping -c 5 [Link]
(you could also do ping -c 5 r3)
Record the following details from the results:
• Size of the ping packet;
• TTL value;
• Minimum round trip time;
• Average round trip time; and
• Maximum round trip time.
10. Start a Wireshark capture and repeat the previous exercise. After the 5 pings have been sent,
stop the capture and examine the ICMP packets sent and received. Select a packet that has Echo
(ping) reply in the information column. Expand the IP section as much as possible (i.e.
expand each of the sub-fields). Record and confirm that the details reported by the ping trace
are the same as what was recorded in the capture. Specifically, examine the ping reply packet
for the following information:
• Source Address;
• Destination Address;
• TTL value;
• Sequence number; and

April 12, 2021 Laboratory Notes - 49202- Communication Protocols 6

REFERENCES REFERENCES

• Payload size (remember that payload = Total Length - Header Length)

Are the details of the ping trace the same as those recorded in the Wireshark capture? Why or
why not?
11. Ping the timetable server again but this time set the IP TTL value to 1:

ping -t 1 -c 5 [Link]
Why are the ping packets failing to reach the web server? Try increasing the TTL in steps of 1
until the ping succeeds. What is the minimum TTL value required to reach the server?
12. Ping the timetable server again but this time set the IP data payload size to 4000 bytes:

ping -s 4000 -c 5 [Link]

Record the results with Wireshark and document in your report. Did the packets get through?
In what form? What is the relationship with the MTU? (you can check the MTU using the ip
addr command).
13. Repeat the ping but this time set the IP packet’s “don’t fragment” (DF) flag:

ping -s 4000 -c 5 -M do [Link]

(the -M do option sets path MTU discovery option “don’t fragment” - there are several other
options, you may read the manual page for more details (man ping)).
Record the output. Do the packets get through to the server this time? Why or why not? What
is the largest packet size which makes it to the destination?
14. We are going to determine what routers are forwarding our packets to the timetable server. Type
the following command:

traceroute [Link]
How many router hops are there to the server? Is this number the same as the minimum TTL
value that you determined earlier?

References
[1] Behrouz A. Forouzan. TCP/IP Protocol Suite. 4th edition, 2017.

April 12, 2021 Laboratory Notes - 49202- Communication Protocols 7