Packet Tracer
Tracer - Investigating the TCP/IP and OSI Models in Action
Topology
Objectives
Part 1 !"a#ine $TTP %eb Tra&&ic
Part ' (isplay !le#ents o& the TCP/IP Protocol S)ite
*ackgro)nd
This simulation activity is intended to provide a f oundation for understanding the TCP/IP protocol suite and the
relationship to the OSI model. Simulation mode allows you to view the data contents being sent across the
network at each layer.
s data moves through
through the network! itit is broken down into smaller pieces
pieces and identified
identified so that the pieces
pieces can
be put back together when they arrive at the destination. "ach piece is assigned a specific name #protocol
data unit $P%&'( and associated with a specific layer of the TCP/IP and OSI models. Packet Tracer simulation
simulation
mode enables you to view each of the layers and the associated P%&. The following
following steps lead the user
through the process of re)uesting a web page from a web server by using the web browser application
available on a client PC.
"ven though much of the information displayed will be discussed in more detail later! this
this is an opportunity to
e*plore the functionality of Packet Tracer and be able to visuali+e the encapsulation process.
Part
Part 1 !"a#
!"a#in
ine
e $TTP
$TTP %eb
%eb Tr
Tra&&i
a&&ic
c
In Part , of this activity!
activity! you will use Packet Tracer #PT( Simulation mode to generate web traffic and e*amine
-TTP.
Step 1 S+itch
S+itch &ro#
&ro# ,ealti#e
,ealti#e to Si#)l
Si#)latio
ation
n #ode
#ode
In the lower right corner of the Packet Tracer interface are tabs to toggle between ,ealti#e and Si#)lation
mode. PT always starts in ,ealti#e mode! in which n etworking protocols operate with realistic timings.
-owever!
-owever! a powerful feature of Packet Tracer allows the user to stop time by switching to Simulation mode.
In Simulation mode! packets are displayed as animated envelopes! time is event driven! and the user can
step through networking events.
a. Click th
the Si#)lation mode icon to switch from ,ealti#e mode to Si#)lation mode.
b. Select $TTP from the !vent .ist ilters.
ilters .
c.
-TTP may alrea
already
dy be the only visible
visible event.
event. Click
Click !dit ilters to display the available visible events.
Toggle the Sho+ All/0one check bo* and notice how the check bo*es switch from unchecked to checked
or checked to unchecked! depending on the current state.
d. Click th
the Sho+ All/0one check bo* until all bo*es are cleared and then select $TTP.
$TTP. Click anywhere
outside of the !dit ilters bo* to hide it. The 0isible "vents should now only display -TTP.
1 23,4
23,4 Cisco
Cisco and/or
and/or its affil
affiliat
iates.
es. ll
ll right
rights
s rese
reserve
rved.
d. This
This docu
docume
ment
nt is
is Cisc
Cisco
o Publ
Public.
ic.
Page
Page 1 of 
Packet Tracer - Investigating the TCP/IP and OSI Models in Action
Step ' 2enerate +eb 3$TTP4 tra&&ic
Currently the Simulation Panel is empty. There are si* columns listed across the top of the "vent 5ist within
the Simulation Panel. s traffic is generated and stepped through! events appear in the list. The In&o column
is used to inspect the contents of a particular event.
0ote6 The 7eb Server and 7eb Client are displayed in the left pane. The panels can be ad8usted in si+e by
hovering ne*t to the scroll bar and dragging left or right when the double9headed arrow appears.
a.
Click %eb Client in the far left pane.
b.
Click the (esktop tab and click the %eb *ro+ser icon to open it.
c.
In the &:5 field! enter +++osilocal and click 2o.
;ecause time in Simulation mode is event9driven! you must use the Capt)re/or+ard button to display
network events.
d.
Click Capt)re/or+ard four times. There should be four events in the "vent 5ist.
5ook at the 7eb Client web browser page. %id anything change<
=o! =othing has change.
Step 5 !"plore the contents o& the $TTP packet
a. Click the first colored s)uare bo* under the !vent .ist > In&o column. It may be necessary to e*pand the
Si#)lation Panel or use the scrollbar directly below the !vent .ist.
The P(6 In&or#ation at (evice %eb Client window displays. In this window! there are only two tabs
#OSI Model and O)tbo)nd P(6 (etails( because this is the start of the transmission. s more events
are e*amined! there will be three tabs displayed! adding a tab for Inbo)nd P(6 (etails. 7hen an event
is the last event in the stream of traffic! only the OSI Model and Inbo)nd P(6 (etails tabs are
displayed.
b. "nsure that the OSI Model tab is selected. &nder the O)t .ayers column! ensure that the .ayer 7 bo* is
highlighted.
7hat is the te*t displayed ne*t to the .ayer 7 label< -TTP.
7hat information is listed in the n umbered steps directly below the In .ayers and O)t .ayers bo*es<
In layers the -TTP client sends a -TTP re)uest to the server while in Out layers there is none.
Click 0e"t .ayer. 5ayer ? should be highlighted. 7hat is the (st Port value<
The %st Port value is @3.
c.
Click 0e"t .ayer. 5ayer 4 should be highlighted. 7hat is the (est IP value<
The %est. IP value is ,A2.,B@.,.2?
d.
Click 0e"t .ayer. 7hat information is displayed at this layer<
The information displayed in this layer is that the IP address is in the same subnet.
e.
Click the O)tbo)nd P(6 (etails tab.
Information listed under the P(6 (etails is reflective of the layers within the TCP/IP model.
0ote6 The information listed under the !thernet II section provides even more detailed information than is
listed under 5ayer 2 on the OSI Model tab. The O)tbo)nd P(6 (etails provides more descriptive and
detailed information. The values under (!ST MAC and S,C MAC within the !thernet II section of the
P(6 (etails appear on the OSI Model tab under 5ayer 2! but are not identified as such.
7hat is the common information listed under the IP section of P(6 (etails as compared to the
information listed under the OSI Model tab< 7ith which layer is it associated<
1 23,4 Cisco and/or its affiliates. ll rights reserved. This document is Cisco Public.
Page ' of 
Packet Tracer - Investigating the TCP/IP and OSI Models in Action
The information listed under the IP Section is that the IP in P%& formats and the 5ayer 4 in out layers are
the same IPDs. It is associated in layer 4.
7hat is the common information listed under the TCP section of P(6 (etails! as compared to the
information listed under the OSI Model tab! and with which layer is it associated<
The information listed under the TCP Section is that the TCP in %P& details and in the OSI Eodel in out
layers the layer ? is the same with each another. It is associated in layer ?.
7hat is the $ost listed under the $TTP section of the P(6 (etails< 7hat layer would this information be
associated with under the OSI Model tab<
The host listed under the -TTP section is the www.osi.local. I think in layer 4 is associated in OSI model.
f.
Click the ne*t colored s)uare bo* under the !vent .ist > In&o column. Only 5ayer , is active #not grayed
out(. The device is moving the frame from the buffer and placing it on to the network.
g. dvance to the ne*t -TTP In&o bo* within the !vent .ist and click the colored s)uare bo*. This window
contains both In .ayers and O)t .ayers. =otice the direction of the arrow directly under the In .ayers
columnF it is pointing upward! indicating the direction the information is travelling. Scroll through these
layers making note of the items previously viewed. t the top of the column the arrow points to the right.
This denotes that the server is now sending the information back to the client.
Comparing the information displayed in the In .ayers column with that of the O)t .ayers column! what
are the ma8or differences<
In layer 2 the "thernet II -eader has change from 33B3.?GC.?%"" >> 333.,.ABA.?3,% to
333,.ABA.?3,% >> 33B3.?GC.?%""
nd the 5ayer 4 the TCP Src Port and %st Port e*change its values in in layers and out layers.
h.
Click the O)tbo)nd P(6 (etails tab. Scroll down to the $TTP section.
7hat is the first line in the -TTP message that displays<
The first line in -TTP message that displays is -TTP/,., 233.
i.
Click the last colored s)uare bo* under the In&o column. -ow many tabs are displayed with this event and
why<
There are ?tabs displayed because the process will 8ust repeat itself.
Part ' (isplay !le#ents o& the TCP/IP Protocol S)ite
In Part 2 of this activity! you will use the Packet Tracer Simulation mode to view and e*amine some of the
other protocols comprising of the TCP/IP suite.
Step 1 8ie+ Additional !vents
a. Close any open P%& information windows.
b. In the "vent 5ist Hilters > 0isible "vents section! click Sho+ All.
7hat additional "vent Types are displayed<
The additional event types are displayed are TCP! %=S! -TTP! :P
These e*tra entries play various roles within the TCP/IP suite. If the ddress :esolution Protocol #:P( is
listed! it searches EC addresses. %=S is responsible for converting a name #for e*ample!
+++osilocal( to an IP address. The additional TCP events are responsible for connecting! agreeing on
communication parameters! and disconnecting the communications sessions between the devices. These
protocols have been mentioned previously and will be further discussed as the course progresses.
Currently there are over 4 possible protocols #event types( available for capture within Packet Tracer.
1 23,4 Cisco and/or its affiliates. ll rights reserved. This document is Cisco Public.
Page 5 of 
Packet Tracer - Investigating the TCP/IP and OSI Models in Action
c.
Click the first %=S event in the In&o column. "*plore the OSI Model and P(6 (etail tabs and note the
encapsulation process. s you look at the OSI Model tab with .ayer 7 highlighted! a description of what
is occurring is listed directly below the In .ayers and O)t .ayers #,. The %=S client sends a %=S )uery
to the %=S server.(. This is very useful information to help understand what is occurring during the
communication process.
d.
Click the O)tbo)nd P(6 (etails tab. 7hat information is listed in the 0AM!6 in the %=S &":J
section<
The information listed is www.osi.local
e. Click the last %=S In&o colored s)uare bo* in the event list. 7hich device is displayed<
The device displayed is the 7eb Client.
7hat is the value listed ne*t to A((,!SS6 in the %=S =S7": section of the Inbo)nd P(6 (etails<
The address listed is ,A2.,B@.,.2?
f.
Hind the first $TTP event in the list and click the colored s)uare bo* of the TCP event immediately
following this event. -ighlight .ayer 9 in the OSI Model tab. In the numbered list directly below the In
.ayers and O)t .ayers! what is the information displayed under items ? and <
These are the information displayed under items ? and  are sent segment information6 the se)uence
number ,! the CK number ,! and the data length ,32.
TCP manages the connecting and disconnecting of the communications channel along with other
responsibilities. This particular event shows that the communication channel has been "ST;5IS-"%.
g. Click the last TCP event. -ighlight 5ayer ? in the OSI Model tab. "*amine the steps listed directly below
In .ayers and O)t .ayers. 7hat is the purpose of this event! based on the information provided in the
last item in the list #should be item ?(<
The purpose of this event is that the 7eb client sending a message to the 7 eb server that the TCP
connection is successful.
Challenge
This simulation provided an e*ample of a web session between a client and a server on a local area network
#5=(. The client makes re)uests to specific services running on the server. The server must be set up to
listen on specific ports for a client re)uest. #-int6 5ook at 5ayer ? in the OSI Model tab for port information.(
;ased on the information that was inspected during the Packet Tracer capture! what port number is the %eb
Server listening on for the web re)uest<
The port number of the web server is ,3?,.
7hat port is the %eb Server listening on for a %=S re)uest<
The port is ,3?,.
1 23,4 Cisco and/or its affiliates. ll rights reserved. This document is Cisco Public.
Page 9 of 
Packet Tracer - Investigating the TCP/IP and OSI Models in Action
S)ggested Scoring ,)bric
Activity Section
Part ,6 "*amine -TTP
7eb Traffic
:)estion
.ocation
Possible
Points
Step 2d

Step 4b9,

Step 4b92

Step 4c

Step 4d

Step 4e

Step 4f9,

Step 4f92

Step 4f94

Step 4h

Step 4i

Step 48

Part 1 Total
Part 26 %isplay "lements of
the TCP/IP Protocol Suite
Step ,b

Step ,d

Step ,e9,

Step ,e92

Step ,f

Step ,g

Part ' Total
Challenge
;<
5<
,

2

Part 5 Total
1<
Total Score
1<<
1 23,4 Cisco and/or its affiliates. ll rights reserved. This document is Cisco Public.
Page  of 
!arned
Points