Exercise 4(A) lab report
Filesystem
1K-blocks
/dev/hda2
18603380
/dev/hda1
101089
none
123344
/dev/fd0
1424
Used Available Use% Mounted on
3315124 14343236 19% /
9325
86545 10% /boot
0
123344
0% /dev/shm
0
1424
0% /mnt/floppy
Exercise 5
1. which file must be edited to change the name of a Linux PC (eg. from PC1 to machine1)?
/etc/sysconfig/network
2. which files include information that determines whether a Linux PC performs IP
forwarding?
/etc/sysconfig/network
3. attach the content of /etc/sysconfig/etwork-scripts/ifcfg-eth0.
DEVICE=eth0
BOOTPROTO=none
BROADCAST=10.0.1.255
IPADDR=10.0.1.11
NETMASK=255.255.255.0
NETWORK=10.0.1.0
ONBOOT=yes
TYPE=Ethernet
USERCTL=no
PEERDNS=no
Exercise 6
1.
[root@PC1 root]# ping -c 5 10.0.1.12
PING 10.0.1.12 (10.0.1.12) 56(84) bytes of
64 bytes from 10.0.1.12: icmp_seq=1 ttl=64
64 bytes from 10.0.1.12: icmp_seq=2 ttl=64
64 bytes from 10.0.1.12: icmp_seq=3 ttl=64
64 bytes from 10.0.1.12: icmp_seq=4 ttl=64
64 bytes from 10.0.1.12: icmp_seq=5 ttl=64
data.
time=0.681
time=0.304
time=0.283
time=0.283
time=0.318
ms
ms
ms
ms
ms
--- 10.0.1.12 ping statistics --5 packets transmitted, 5 received, 0% packet loss, time 4011ms
rtt min/avg/max/mdev = 0.283/0.373/0.681/0.156 ms
2.
[root@PC2 root]# ping -c 5 10.0.1.11
PING 10.0.1.11 (10.0.1.11) 56(84) bytes of
64 bytes from 10.0.1.11: icmp_seq=1 ttl=64
64 bytes from 10.0.1.11: icmp_seq=2 ttl=64
64 bytes from 10.0.1.11: icmp_seq=3 ttl=64
64 bytes from 10.0.1.11: icmp_seq=4 ttl=64
64 bytes from 10.0.1.11: icmp_seq=5 ttl=64
data.
time=0.293
time=0.274
time=0.275
time=0.273
time=0.275
ms
ms
ms
ms
ms
--- 10.0.1.11 ping statistics --5 packets transmitted, 5 received, 0% packet loss, time 3996ms
rtt min/avg/max/mdev = 0.273/0.278/0.293/0.007 ms
[root@PC2 root]# ping -c 5 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64
64 bytes from 127.0.0.1: icmp_seq=3 ttl=64
64 bytes from 127.0.0.1: icmp_seq=4 ttl=64
64 bytes from 127.0.0.1: icmp_seq=5 ttl=64
data.
time=0.039
time=0.030
time=0.029
time=0.033
time=0.031
ms
ms
ms
ms
ms
--- 127.0.0.1 ping statistics --5 packets transmitted, 5 received, 0% packet loss, time 3996ms
rtt min/avg/max/mdev = 0.029/0.032/0.039/0.006 ms
Explain the difference between pinging the local Ethernet interface and the loopback
interface.
Since A loopback is a communications channel with only one endpoint. Any message transmitted
through such a channel is immediately received by the selfsame channel. As you can see,
loopback is much faster because it loops back to itself.
Exercise 7(A)
[root@PC1 root]# tcpdump -n host 10.0.1.12
tcpdump: listening on eth0
13:32:26.212539 10.0.1.11 > 10.0.1.12: icmp: echo request (DF)
13:32:26.212816 10.0.1.12 > 10.0.1.11: icmp: echo reply
13:32:31.203513 arp who-has 10.0.1.11 tell 10.0.1.12
13:32:31.203541 arp reply 10.0.1.11 is-at 0:0:c0:6b:4d:0
4 packets received by filter
0 packets dropped by kernel
Explain the meaning of each field in the captured data
13:32:26.212539 10.0.1.11 > 10.0.1.12: icmp: echo request (DF)
[--timestamp--][--src.ip--][--dest.ip-][packet headers from other protocol]
Exercise 7(B)
[root@PC1 root]# ping -c 1 111.111.111.111
connect: Network is unreachable
[root@PC1 root]# ping -c 2 -b 10.0.1.255
WARNING: pinging broadcast address
PING 10.0.1.255 (10.0.1.255) 56(84) bytes of data.
64 bytes from 10.0.1.11: icmp_seq=1 ttl=64 time=0.064
64 bytes from 10.0.1.12: icmp_seq=1 ttl=64 time=0.352
64 bytes from 10.0.1.13: icmp_seq=1 ttl=64 time=0.543
64 bytes from 10.0.1.14: icmp_seq=1 ttl=64 time=0.754
ms
ms (DUP!)
ms (DUP!)
ms (DUP!)
64 bytes from 10.0.1.11: icmp_seq=2 ttl=64 time=0.037 ms
--- 10.0.1.255 ping statistics --2 packets transmitted, 2 received, +3 duplicates, 0% packet loss, time 1004ms
rtt min/avg/max/mdev = 0.037/0.350/0.754/0.275 ms
[root@PC1 root]# tcpdump -n
tcpdump: listening on eth0
13:35:55.181192 10.0.1.11 > 10.0.1.255: icmp: echo request (DF)
13:35:55.181473 10.0.1.12 > 10.0.1.11: icmp: echo reply
13:35:55.181563 arp who-has 10.0.1.11 tell 10.0.1.14
13:35:55.181597 arp reply 10.0.1.11 is-at 0:0:c0:6b:4d:0
13:35:55.181664 10.0.1.13 > 10.0.1.11: icmp: echo reply
13:35:55.181875 10.0.1.14 > 10.0.1.11: icmp: echo reply
13:35:56.185496 10.0.1.11 > 10.0.1.255: icmp: echo request (DF)
13:35:56.185756 10.0.1.14 > 10.0.1.11: icmp: echo reply
13:35:56.185982 10.0.1.12 > 10.0.1.11: icmp: echo reply
13:35:56.186082 10.0.1.13 > 10.0.1.11: icmp: echo reply
13:36:00.173551 arp who-has 10.0.1.11 tell 10.0.1.13
13:36:00.173577 arp reply 10.0.1.11 is-at 0:0:c0:6b:4d:0
13:36:00.178713 arp who-has 10.0.1.11 tell 10.0.1.12
13:36:00.178735 arp reply 10.0.1.11 is-at 0:0:c0:6b:4d:0
14 packets received by filter
0 packets dropped by kernel
Explaination
Since 111.111.111.111 is a nonexisting IP address. Net work is not reachable and tcpdump
did not capture any data when we ping 111.111.111.111.
Since 10.0.1.255 is a broadcast address, every PCs replies to it when we ping 10.0.1.255
How many of the Linux PCs responded to the broadcase ping?
3, namely 10.0.1.12, 10.0.1.13, 10.0.1.14
Exercise 8
Frame 1 (98 bytes on wire, 98 bytes captured)
Arrival Time: Apr 8, 2005 13:43:14.796713000
Time delta from previous packet: 0.000000000 seconds
Time relative to first packet: 0.000000000 seconds
Frame Number: 1
Packet Length: 98 bytes
Capture Length: 98 bytes
Ethernet II, Src: 00:00:c0:6b:4d:00, Dst: 00:04:75:ad:02:17
Destination: 00:04:75:ad:02:17 (00:04:75:ad:02:17)
Source: 00:00:c0:6b:4d:00 (00:00:c0:6b:4d:00)
Type: IP (0x0800)
Internet Protocol, Src Addr: 10.0.1.11 (10.0.1.11), Dst Addr: 10.0.1.13 (10.0.1.13)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 84
Identification: 0x0000 (0)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: ICMP (0x01)
Header checksum: 0x2492 (correct)
Source: 10.0.1.11 (10.0.1.11)
Destination: 10.0.1.13 (10.0.1.13)
Internet Control Message Protocol
Type: 8 (Echo (ping) request)
Code: 0
Checksum: 0x716e (correct)
Identifier: 0x4736
Sequence number: 00:01
Data (56 bytes)
0000
0010
0020
0030
e2
10
20
30
ec
11
21
31
56
12
22
32
42
13
23
33
0f
14
24
34
28
15
25
35
0c
16
26
36
00 08 09 0a 0b 0c 0d 0e 0f
17 18 19 1a 1b 1c 1d 1e 1f
27 28 29 2a 2b 2c 2d 2e 2f
37
..VB.(..........
................
!"#$%&'()*+,-./
01234567
Frame 2 (98 bytes on wire, 98 bytes captured)
Arrival Time: Apr 8, 2005 13:43:14.796994000
Time delta from previous packet: 0.000281000 seconds
Time relative to first packet: 0.000281000 seconds
Frame Number: 2
Packet Length: 98 bytes
Capture Length: 98 bytes
Ethernet II, Src: 00:04:75:ad:02:17, Dst: 00:00:c0:6b:4d:00
Destination: 00:00:c0:6b:4d:00 (00:00:c0:6b:4d:00)
Source: 00:04:75:ad:02:17 (00:04:75:ad:02:17)
Type: IP (0x0800)
Internet Protocol, Src Addr: 10.0.1.13 (10.0.1.13), Dst Addr: 10.0.1.11 (10.0.1.11)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 84
Identification: 0xd49b (54427)
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: ICMP (0x01)
Header checksum: 0x8ff6 (correct)
Source: 10.0.1.13 (10.0.1.13)
Destination: 10.0.1.11 (10.0.1.11)
Internet Control Message Protocol
Type: 0 (Echo (ping) reply)
Code: 0
Checksum: 0x796e (correct)
Identifier: 0x4736
Sequence number: 00:01
Data (56 bytes)
0000
0010
0020
0030
e2
10
20
30
ec
11
21
31
56
12
22
32
42
13
23
33
0f
14
24
34
28
15
25
35
0c
16
26
36
00 08 09 0a 0b 0c 0d 0e 0f
17 18 19 1a 1b 1c 1d 1e 1f
27 28 29 2a 2b 2c 2d 2e 2f
37
..VB.(..........
................
!"#$%&'()*+,-./
01234567
Frame 3 (98 bytes on wire, 98 bytes captured)
Arrival Time: Apr 8, 2005 13:43:15.795707000
Time delta from previous packet: 0.998713000 seconds
Time relative to first packet: 0.998994000 seconds
Frame Number: 3
Packet Length: 98 bytes
Capture Length: 98 bytes
Ethernet II, Src: 00:00:c0:6b:4d:00, Dst: 00:04:75:ad:02:17
Destination: 00:04:75:ad:02:17 (00:04:75:ad:02:17)
Source: 00:00:c0:6b:4d:00 (00:00:c0:6b:4d:00)
Type: IP (0x0800)
Internet Protocol, Src Addr: 10.0.1.11 (10.0.1.11), Dst Addr: 10.0.1.13 (10.0.1.13)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 84
Identification: 0x0000 (0)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: ICMP (0x01)
Header checksum: 0x2492 (correct)
Source: 10.0.1.11 (10.0.1.11)
Destination: 10.0.1.13 (10.0.1.13)
Internet Control Message Protocol
Type: 8 (Echo (ping) request)
Code: 0
Checksum: 0x5771 (correct)
Identifier: 0x4736
Sequence number: 00:02
Data (56 bytes)
0000
0010
0020
0030
e3
10
20
30
ec
11
21
31
56
12
22
32
42
13
23
33
28
14
24
34
24
15
25
35
0c
16
26
36
00 08 09 0a 0b 0c 0d 0e 0f
17 18 19 1a 1b 1c 1d 1e 1f
27 28 29 2a 2b 2c 2d 2e 2f
37
..VB($..........
................
!"#$%&'()*+,-./
01234567
Frame 4 (98 bytes on wire, 98 bytes captured)
Arrival Time: Apr 8, 2005 13:43:15.796057000
Time delta from previous packet: 0.000350000 seconds
Time relative to first packet: 0.999344000 seconds
Frame Number: 4
Packet Length: 98 bytes
Capture Length: 98 bytes
Ethernet II, Src: 00:04:75:ad:02:17, Dst: 00:00:c0:6b:4d:00
Destination: 00:00:c0:6b:4d:00 (00:00:c0:6b:4d:00)
Source: 00:04:75:ad:02:17 (00:04:75:ad:02:17)
Type: IP (0x0800)
Internet Protocol, Src Addr: 10.0.1.13 (10.0.1.13), Dst Addr: 10.0.1.11 (10.0.1.11)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 84
Identification: 0xd49c (54428)
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: ICMP (0x01)
Header checksum: 0x8ff5 (correct)
Source: 10.0.1.13 (10.0.1.13)
Destination: 10.0.1.11 (10.0.1.11)
Internet Control Message Protocol
Type: 0 (Echo (ping) reply)
Code: 0
Checksum: 0x5f71 (correct)
Identifier: 0x4736
Sequence number: 00:02
Data (56 bytes)
0000
0010
0020
0030
e3
10
20
30
ec
11
21
31
56
12
22
32
42
13
23
33
28
14
24
34
24
15
25
35
0c
16
26
36
00 08 09 0a 0b 0c 0d 0e 0f
17 18 19 1a 1b 1c 1d 1e 1f
27 28 29 2a 2b 2c 2d 2e 2f
37
..VB($..........
................
!"#$%&'()*+,-./
01234567
Frame 5 (60 bytes on wire, 60 bytes captured)
Arrival Time: Apr 8, 2005 13:43:19.790273000
Time delta from previous packet: 3.994216000 seconds
Time relative to first packet: 4.993560000 seconds
Frame Number: 5
Packet Length: 60 bytes
Capture Length: 60 bytes
Ethernet II, Src: 00:04:75:ad:02:17, Dst: 00:00:c0:6b:4d:00
Destination: 00:00:c0:6b:4d:00 (00:00:c0:6b:4d:00)
Source: 00:04:75:ad:02:17 (00:04:75:ad:02:17)
Type: ARP (0x0806)
Trailer: 00000000000000000000000000000000...
Address Resolution Protocol (request)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (0x0001)
Sender MAC address: 00:04:75:ad:02:17 (00:04:75:ad:02:17)
Sender IP address: 10.0.1.13 (10.0.1.13)
Target MAC address: 00:00:00:00:00:00 (00:00:00:00:00:00)
Target IP address: 10.0.1.11 (10.0.1.11)
Frame 6 (42 bytes on wire, 42 bytes captured)
Arrival Time: Apr 8, 2005 13:43:19.790301000
Time delta from previous packet: 0.000028000 seconds
Time relative to first packet: 4.993588000 seconds
Frame Number: 6
Packet Length: 42 bytes
Capture Length: 42 bytes
Ethernet II, Src: 00:00:c0:6b:4d:00, Dst: 00:04:75:ad:02:17
Destination: 00:04:75:ad:02:17 (00:04:75:ad:02:17)
Source: 00:00:c0:6b:4d:00 (00:00:c0:6b:4d:00)
Type: ARP (0x0806)
Address Resolution Protocol (reply)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reply (0x0002)
Sender MAC address: 00:00:c0:6b:4d:00 (00:00:c0:6b:4d:00)
Sender IP address: 10.0.1.11 (10.0.1.11)
Target MAC address: 00:04:75:ad:02:17 (00:04:75:ad:02:17)
Target IP address: 10.0.1.13 (10.0.1.13)
Describe the differences between the files saved by tcpdump and by ethereal.
tcpdump displays one line for each transmitted or received Ethernet frame. In each line,
tcpdump displays a timestamp and information that is derived from the protocol headers
contained in the Ethernet frame. If the Ethernet frame is an IP datagram with UPD or TCP
payload, then tcpdump displays information on the source and the destination of the frame.
Ethereal recognizes a large number of protocols. Besides display the time, source ip address
and destination ip address and packet headers from other protocols (which are what tcpdump
displays), for each frame, ethereal also displays frame number, packet length, capture
length as well as all information of each frame in different protocols such as IP, ICMP,
ARP according to the type of each frame.