MIS 307 – Business Data Communications and Networking

Lab 2: TCP/IP and Ethernet – Updated: Sept. 20 2020

NAME: Justin Quen

Complete this homework by adding your answers and screenshots directly in this document. When finished, save
this document as Lab2_FirstName_LastName.docx and upload it to D2L using the TurnItIn link.

TCP/IP configuration (7 points)

1. Every computer that is on the LAN/Internet and uses TCP/IP needs 4 things. Follow the instructions below
and find these 4 things for your computer and explain why and how they are used.
2. To view your current network settings

i. Go to System Preferences and click on Network

ii. Select the network you are connected to and then click on Advanced…
iii. Use the different tabs to answer the questions below
3. Paste the screen shot(s) of the results below, then fill out the table. (5 POINTS)

Page 1 of 9
MIS 307 – Business Data Communications and Networking
Lab 2: TCP/IP and Ethernet – Updated: Sept. 20 2020
Your computer’s Why is this needed? How does your
computer obtain this?
Its IP address 192.168.0.166 This is needed so that the network is
able to identify the device and locate
it for addressing purposes. The IP
address is assigned through ISP with
the help of the router and modem.
Subnet mask 255.255.255.0 The subnet mask is needed in order
to mask the location of an IP
address. It divides the IP address
into host and network addresses.
IP address of DNS server 68.105.28.11 The DNS is needed to translate
domain names into IP addresses.
The ISP also assigns the DNS IP.
IP address of subnet gateway 192.168.0.1 The gateway is needed in order to
send traffic to other available
networks. This device identifies the
client and the host.
MAC Addresses (you may a8:66:7f:0f:5f:00 MAC Addresses are needed to
have more than one) establish an address for
communication with other
networks. MAC Addresses are
determined during the
manufacturing process.

4. Now take one of your MAC Address and convert the Hexadecimal values to Binary (2 points).
a8:66:7f:0f:5f:00= 1010100001100110011111111000011110101111100000000

DHCP (6 points)
DHCP is used to dynamically assign IP addresses to hosts. We will observe the DHCP packets captured by a client
as we don’t have access to the DHCP server.
PC: Paste a screenshot of ipconfig /all
Mac: Paste a screenshot of the Advanced Network Preferences with the DHCP information

Page 2 of 9
MIS 307 – Business Data Communications and Networking
Lab 2: TCP/IP and Ethernet – Updated: Sept. 20 2020

1. Do you have a static, or a DHCP IP address? DHCP (2 points)

2. Open Wireshark and start capturing packets. Do as instructed below, then stop capturing packets. Observe
the capture packets and answer the following questions. To only see the DHCP packets, enter ‘bootp’ in the
filter.
3. Mac:
a. Enter: sudo ipconfig set en0 DHCP
b. Show a screenshot of your Wireshark packets. Explain what happened. (4 points)

Page 3 of 9
MIS 307 – Business Data Communications and Networking
Lab 2: TCP/IP and Ethernet – Updated: Sept. 20 2020
4.

This sends a release request to the DHCP server that terminates the lease on the device’s IP address, and
makes the IP that was just released available. The renew ipconfig tells the DHCP that a new IP address is
needed.

TCP (22 points)

The goal of this assignment is to observe the 3-way handshake to initiate a TCP connection, the use of TCP in data
transfer, and the ending of a TCP connection.

1. Open the TCP_Example.cap file in Wireshark.

2. What is the purpose of the first three frames? (1 point) The purpose of these frames is to establish a
connection between the sender and receiver.
Packet 1: (2 POINTS)
a. What is the purpose of this packet? Request connection through Syn
b. What is the source port number? 54841
c. What is the destination port number? 80
d. What is the sequence number? 4129057982 –(Raw) 0-(Relative)
e. What is the acknowledgement number? 0 0(Raw)
f. Which flags are set? Why? Syn 1 is the only flag that’s set. This is the first synchronizing
sequence number during the connection process, which is why it’s the only flag that is set.

Page 4 of 9
MIS 307 – Business Data Communications and Networking
Lab 2: TCP/IP and Ethernet – Updated: Sept. 20 2020
g. How many more bytes of data can the destination computer accept? 1460 bytes

Packet 2: (2 POINTS)
a. What is the purpose of this packet? Packet 2 is responsible for acknowledging that the packet
has been received by the server and agrees to connect.
b. What is the source port number? 80
c. What is the destination port number? 54841
d. What is the sequence number? Why? 4200111240- (Raw) 0- (Relative). This is because this is
still part of the 0 sequence because there is no data.
e. What is the acknowledgement number? Why? 4129057983- (Raw) 1- (Relative). This is the
first acknowledgement number because the connection has been established.
f. Which flags are set? Why? Both the Syn and Ack flags are set because the connection has been
established and an acknowledgment number has now been sent back.
g. How many more bytes of data can the destination computer accept? 1460 bytes

Packet 3: (2 POINTS)
a. What is the purpose of this packet? In this packet, the client is acknowledging the message
from the server.
b. What is the sequence number? Why? 4129057983- (Raw) 1- (Relative). This is because the
packet before has an Ack number of 1.
c. What is the acknowledgement number? Why? 4200111241- (Raw) 1- (Relative). This is
because the acknowledgement of the established connection is the same as before.
d. Which flags are set? Why? The acknowledgment flag is set because the connection is now
established.
e. How many more bytes of data can the destination computer accept? 1460 bytes
3. What is the purpose of frames 4 to 37? The purpose of these frames is to transfer data. (1 points)
Why is the sequence number the same for all of the odd frames from 5 – 35 (frames from 192.168.1.2
174.143.213.184)? (1 point) This is because it is a continuation of the connection
The even numbered frames are 1514 bytes in length. What is the size of the payload in the TCP segment?
How did you determine this? (2 points) The size of the payload is 1448 bytes, it can be found under
timestamps.
What is the purpose of Frame 36? (1 point) This is showing that all the data from the website that the
client has requested has arrived.

Page 5 of 9
MIS 307 – Business Data Communications and Networking
Lab 2: TCP/IP and Ethernet – Updated: Sept. 20 2020
Answer the following questions about frames 38-40.
Packet #38 (2 POINTS)
a. What is the purpose of this packet? To begin the process of terminating the connection.
b. What is the source port number? 54841
c. What is the destination port number? 80
d. What is the sequence number? 4129058708- (Raw) 726- (Relative)
e. What is the acknowledgement number? 4200134191- (Raw) 22951- (Relative)
f. Which flags are set? Why? The Ack and Fin flags are set to acknowledge that the connection
will be terminated.

Packet #39 (2 POINTS)

a. What is the purpose of this packet? The purpose of this packet is to acknowledge the request to
terminate the connection from the last packet (38).
b. What is the sequence number? Why? ? 4200134191- (Raw) 22951- (Relative). This is because
the last packet was expecting this number from previous acknowledgement number.
c. What is the acknowledgement number? Why? 4129058709 – (Raw) 727-( Relative). This is
because the next sequence number should be 727.

d. Which flags are set? Why? Both the Fin and Ack flags are set in order to acknowledge the
connection between sender and receiver to terminate.

Packet #40 (2 POINTS)

a. What is the purpose of this packet? This packet shows that the connection is terminated.
b. What is the sequence number? Why? 4129058709- (Raw) 727- (Relative). This because the
prior packet’s acknowledgement number was 727.
c. What is the acknowledgement number? Why? 4200134191- (Raw) 22952- (Relative). This is
because the sequence number from the client is 22951.
d. Which flags are set? Why? The Ack flag is set to demonstrate that the connection is terminated.

Draw a picture that represents the flow of packets for the TCP 3-way handshake. Make sure you include the
sequence number & acknowledgement numbers in your picture in the following format [SYN, ACK] (3 POINTS)

Page 6 of 9
MIS 307 – Business Data Communications and Networking
Lab 2: TCP/IP and Ethernet – Updated: Sept. 20 2020

Page 7 of 9
MIS 307 – Business Data Communications and Networking
Lab 2: TCP/IP and Ethernet – Updated: Sept. 20 2020

Ethernet and ARP (5 points)

To obtain the MAC address of a node, an ARP request is sent out. MAC address is used by Ethernet to deliver a
packet from hop-to-hop. To view your ARP Cache:

1. Open command prompt or terminal and enter: arp –a

2. Paste a screenshot of your ARP table. You may not find any ARP cache entries. Is this an error? Why or
why not? (1 POINTS)
This is not an error because other IP addresses were found.

Capture and look inside an ARP packet in Wireshark

1. Open a command prompt or terminal.

2. Open your ARP table with arp –a
3. Choose one of your dynamic addresses from the table and write down the IP address, you’ll need it
again. Remove the address from the arp table with the following command arp –d ipaddress
(ipaddress is the IP of the entry you want to remove).
4. Verify that the entry in your ARP table for this IP address has been removed with arp -a
5. Start Wireshark
6. Put “arp” in the filter box
7. Start capturing packets in Wireshark.
8. Ping the IP address of the entry you deleted from the command prompt: ping ipaddress
Page 8 of 9
MIS 307 – Business Data Communications and Networking
Lab 2: TCP/IP and Ethernet – Updated: Sept. 20 2020
9. Stop the Wireshark capture and verify that your computers ARP table was updated with a new entry
for the IP address you just pinged.
10. Find the ARP packet corresponding to the IP address you just pinged (hint: look for the Who has
ipaddress in the Info field).
11. Paste a screenshot of the ARP packet contents from Wireshark (1 POINT)

12. How is an ARP packet transferred? (1 POINTS)

The device starts by sending a request message to the arp with the receiving address IP. Every
device that’s on the network will see the request, however, only the device with the
corresponding IP address will respond with its MAC address.
13. Are ARP packets routable on the Internet? Explain why or why not. (1 POINTS)
They are not, because it is a network protocol.
14. Based on the information provided in the ARP packet, can the ARP messages leave the subnet? Explain
why or why not.
(1 POINTS)

ARP messages can be left on the subnet, this is because within one network the subnets are
connected.

Page 9 of 9