Wireshark Lab: Ethernet and ARP v7.0

0. 实验文件地址

Wireshark Lab: Ethernet and ARP v7.0

数据字段（46~1500字节）：这个字段承载了IP数据报。以太网的最大传输单元（MTU）是1500字节。
目的地址（6字节）：这个字段包含目的适配器的MAC地址。
源地址（6字节）：这个字段包含了传输到该帧到局域网上的适配器的MAC地址。
类型字段（2字节）：类型字段允许以太网复用多种网络层协议。
CRC（4字节）：CRC（循环冗余检测）使得接收适配器的检测帧中是否引入了差错。
前同步码（8字节）：以太网以一个8字节的前同步码字段开始（前同步码请自行百度）。

1. Capturing and analyzing Ethernet frames

Question & Answer

1. What is the 48-bit Ethernet address of your computer?

2. What is the 48-bit destination address in the Ethernet frame? Is this the Ethernet address of gaia.cs.umass.edu? (Hint: the answer is no). What device has this as its Ethernet address? [Note: this is an important question, and one that students sometimes get wrong. Re-read pages 468-469 in the text and make sure you understand the answer here.]

这个目的MAC地址是路由器接口的地址。如果是目的主机的MAC地址，那么源主机所在的子网上的所有适配器都不会费心将IP数据报传递到它的网络层。

3. Give the hexadecimal value for the two-byte Frame type field. What upper layer protocol does this correspond to?

4. How many bytes from the very start of the Ethernet frame does the ASCII “G” in “GET” appear in the Ethernet frame?

前3行都是16字节，第4行到0x47有7个字节，总共55个字节。

5. What is the value of the Ethernet source address? Is this the address of your computer, or of gaia.cs.umass.edu (Hint: the answer is no). What device has this as its Ethernet address?

这个MAC地址是路由器的接口地址。

6. What is the destination address in the Ethernet frame? Is this the Ethernet address of your computer?

这个MAC不是源主机的，而是源主机所在子网的路由器的接口地址。

7. Give the hexadecimal value for the two-byte Frame type field. What upper layer protocol does this correspond to?

8. How many bytes from the very start of the Ethernet frame does the ASCII “O” in “OK” (i.e., the HTTP response code) appear in the Ethernet frame?

14个字节。

2. The Address Resolution Protocol

9. Write down the contents of your computer’s ARP cache. What is the meaning of each column value?

10. What are the hexadecimal values for the source and destination addresses in the Ethernet frame containing the ARP request message?

11. Give the hexadecimal value for the two-byte Ethernet Frame type field. What upper layer protocol does this correspond to?

12.

a. How many bytes from the very beginning of the Ethernet frame does the ARP opcode field begin?

可以从上图看出，opcode之前有20个字节。

b. What is the value of the opcode field within the ARP-payload part of the Ethernet frame in which an ARP request is made?

如上图所示，opcode为0x0001。

c. Does the ARP message contain the IP address of the sender?

d. Where in the ARP request does the “question” appear – the Ethernet address of the machine whose corresponding IP address is being queried?

从opcode可以看出，request。

13. Now find the ARP reply that was sent in response to the ARP request.

a. How many bytes from the very beginning of the Ethernet frame does the ARP opcode field begin?

在opcode之前有20个字节。

b. What is the value of the opcode field within the ARP-payload part of the Ethernet frame in which an ARP response is made?

如上图所示，opcode的值为0x0002。

c. Where in the ARP message does the “answer” to the earlier ARP request appear – the IP address of the machine having the Ethernet address whose corresponding IP address is being queried?

14. What are the hexadecimal values for the source and destination addresses in the Ethernet frame containing the ARP reply message?

15.

查询APR报文是在广播帧中发送的（子网中的所有电脑都能收到），而响应APR报文在一个标准帧中发送（只有发送请求的那台电脑能收到）。