wireshark抓包实验之TCP(陕师大).doc

实验六 Wireshark Lab: TCP 一、实验目的 1.通过wireshark抓包理解应用层TCP协议。 二、实验器材 1.PC机电脑一台。 2.Wireshark软件。 三、实验内容 1．依照Wireshark Lab 提供的实验步骤完成实验。 2．回答实验中的问题。 四、实验操作实践与步骤 2. A first look at the captured trace 1. What is the IP address and TCP port number used by the client computer (source) that is transferring the file to ? To answer this question, it’s probably easiest to select an HTTP message and explore the details of the TCP packet used to carry this HTTP message, using the “details of the selected packet header window” 2. What is the IP address of ? On what port number is it sending and receiving TCP segments for this connection? If you have been able to create your own trace, answer the following question: 3. What is the IP address and TCP port number used by your client computer (source) to transfer the file to ? 3. TCP Basics 4. (1)What is the sequence number of the TCP SYN segment that is used to initiate the TCP connection between the client computer and ? (2)What is it in the segment that identifies the segment as a SYN segment? (1) SYN sequence number =0 (2) What is in the red region of the figure above identifies the segment as a SYN segment. 5. (1)What is the sequence number of the SYNACK segment sent by to the client computer in reply to the SYN?(2) What is the value of the ACKnowledgement field in the SYNACK segment? How did determine that value? What is it in the segment that identifies the segment as a SYNACK segment? (1)SYNACK sequence number =0, ACKnowledgement=1 (2)ACKnowledgement value= initiate sequence number of the TCP SYN segment+1 (3)What is in the red region of the figure above identifies the segment as a SYN segment. 6. What is the sequence number of the TCP segment containing the HTTP POST command? Note that in order to find the POST command, you’ll need to dig into the packet content field at the bottom of the Wireshark window, looking for a segment with a “POST” within its DATA field. The sequence number of the TCP segment cont