https://docs.google.com/Doc?

id=dg34rcvn_60c9v5jgcb&pli=1

Continuation or non HTTP Traffic: dng ny ethereal hiu packet ny l HTTP protocol,phn data chnh l HTTP data: l cc gi tin tip tc i vo v mi MTU ch c gii gin bng y byte thi. time delta from previous packet: thi gian vng ng bng t gi trc time since reference or first frame: thi gian k t khi tham kho hoc frame u tin capture: nm bt protocol: giao thc header length: tiu chiu di differentiated services field:s khc bit ca lnh vc dick v identification: xc nh fragment: on sequence number: s th t checksum: tng kim tra ARP: 1. Gii thiu ARP a) Tng Quan ARP (Address Resolution Protocol) l phng thc phn gii a ch ng gia a ch lp network (a ch 32 bit) v a ch lp datalink (a ch 48 bit) nhm gip cho vic truyn d liu c lin tc qua mng. Qu trnh thc hin bng cch: mt thit b IP trong mng gi mt gi tin broadcast n ton mng yu cu thit b khc gi tr li a ch phn cng (a ch lp datalink) ca mnh. b) C ch hot ng Qu trnh thc hin ARP c bt u khi mt thit b ngun trong mt mng IP c nhu cu gi mt gi tin IP. Trc ht thit b phi xc nh xem a ch IP ch ca gi tin c phi nm cng trong mng ni b ca mnh hay khng. Nu ng vy th thit b s gi trc tip gi tin n thit b ch. Nu a ch IP ch nm trn mng khc, th thit b s gi gi tin n mt trong cc router nm cng trn mng ni b router ny lm nhim v forward gi tin. C hai trng hp ta u thy c l thit b phi gi tin IP n mt thit b IP khc trn cng mng ni b. Ta bit rng vic gi gi tin trong cng mng thng qua Switch l da vo a ch MAC hay a ch phn cng ca thit b. Sau khi gi tin oc ng gi th mi bt u c chuyn qua qu trnh phn gii a ch ARP v c chuyn i. ARP v c bn l mt qu trnh 2 chiu request/response gia cc thit b trong cng mng ni b. Thit b ngun request bng cch gi mt bn tin broadcast trn ton mng. Thit b ch response bng mt bn tin unicast n thit b ngun.

c) Cc loi bn tin ARP C hai dng bn tin trong ARP : mt c gi t ngun n ch, v mt c gi t ch ti ngun. Request : Khi to qu trnh, gi tin c gi t thit b ngun ti thit b ch Reply : L qu trnh p tr gi tin ARP request, c gi t my ch n my ngun C 4 loi a ch trong mt bn tin ARP : Sender Hardware Address : a ch lp hai ca thit b gi bn tin Sender Protocol Address : a ch lp ba ( hay a ch logic ) ca thit b gi bn tin Target Hardware Address : a ch lp hai ( a ch phn cng ) ca thit b ch ca bn tin Target Protocol Address : a ch lp ba ( hay a ch logic ) ca thit b ch ca bn tin 2. Phn tch gi tin ARP a) Thc hin: B1: start chng trnh Ethreal, chn interface v bt u bt gi tin B2: ping a ch IP ca my trong mng ni b B3: stop ethereal. b) Kt qu Nhn c cc gi tin ARP trn Ehereal: c) Phn tch: Phn tch gi tin ARP

 Phn tch gi tin ARP reply

----> B SUNG BI VIT<----

--------------------------------------------------------------Phn tch gi tin DNS a) Thc hin: B1: m trnh duyt B2: start chng trnh Ethreal, lc gi tin DNS bng cch g vo mc filter t kha ip.addr==<DiaChiIP> lc cc gi tin DNS phn gii qua localhost (trong tp tin hosts C:\WINDOWS\system32\drivers\etc\hosts) B3: chn interface v bt u bt gi tin B4: g vo trnh duyt: http://www.ietf.org -> Enter B5: stop ethereal. b) Kt qu Nhn c trang HTML Nhn c cc gi tin DNS, TCP trn Ehereal: c) Phn tch: Phn tch gi tin DNS

Phn tch gi tin DNS response

 Phn gii tn min khi c lin kt n resource t mt trang web khc

Xin cho mi ngi. Chc l ai tm hiu v mng, hn s bit n phn mm ethereal dng bt cc gi tin trn mng. Xin c gii thiu cc s dng v phn tch 1 s gi tin. Bn cnh Ethereal cn c Wireshark chc

nng cng tng t nhng tt hn Ethereal nhiu mt, v cng d s dng hn. M chng trnh Ethereal, ch chn chc nng bt cc gi tin TCP. Chn card mng v bt u capture. Ch tt cc dch v mng Ethereal khng bt cc gi tin khc ngoi gi tin ca trang web mnh ang truy cp. M trnh duyt (dng about:blank khi m ra s khng truy cp vo bt k trang web no khng bt cc gi tin lung tung => thun tin cho vic phn tch gi tin). G vo web brower a ch: http://www.tuoitre.com.vn. Sau
xem trn phn mm Ethereal v stop capture. Ta c 18 gi tin nh sau:

Gi 1,2,3: Bt tay 3 bc ca giao thc TCP. Gi 4: Trnh duyt ti PC gi HTTP GET ly ni dung trang web v.
Gi 5: Web server ng . Gi 6: PC Gi HTTP GET n server yu cu ly ni dung trang /Tianyon/Index.aspx Gi 7,8,10,11,13,14,16,17: Data trang index.aspx bo tui tr c server gi v PC. Do data ln nn chia lm nhiu gi tin. Gi 9,12,15: PC gi ACK n web server (bo hiu nhn c). V TCP l giao thc truyn ti tin cy nn lun c ACK tr v server bo hiu => m bo khng b mt gi (v nu mt => truyn li).