CN LAB 6

K214548 Muhammad Uzair Abbasi

Section 6A

Task 1:

1) Is your browser running HTTP version 1.0 or 1.1? What version of HTTP is the server
running?

2) What languages (if any) does your browser indicate that it can accept to the server?

3) What is the IP address of your computer? Of the gaia.cs.umass.edu server?

Computer Ip: 192.168.100.7
gaia.cs.umass.edu IP: 128.119.245.12
4) What is the status code returned from the server to your browser?

5) When was the HTML file that you are retrieving last modified at the server?

6) How many bytes of content are being returned to your browser?

Task 2:

1) Inspect the contents of the first HTTP GET request from your browser to the server. Do you
see an “IF-MODIFIED-SINCE” line in the HTTP GET?

2) Inspect the contents of the server response. Did the server explicitly return the contents of
the file? How can you tell?

No such explicit content return because it was same as i open it first time

3) Now inspect the contents of the second HTTP GET request from your browser to the server.
Do you see an “IF-MODIFIED-SINCE:” line in the HTTP GET? If so, what information follows
the “IF- MODIFIED-SINCE:” header?
4) What is the HTTP status code and phrase returned from the server in response to this
second HTTP GET? Did the server explicitly return the contents of the file? Explain.
304 Not modified

Task 3:

1. How many HTTP GET request messages did your browser send? Which packet number in
the trace contains the GET message for the Bill or Rights?
1 Get request
2. Which packet number in the trace contains the status code and phrase associated with the
response to the HTTP GET request?

3. What is the status code and phrase in the response?

Status Code : 200
Response Phrase: OK

4. How many data-containing TCP segments were needed to carry the single HTTP response
and the text of the Bill of Rights?

Task 4:http://gaia.cs.umass.edu/wireshark-labs/HTTP-wireshark-file4.html

1. How many HTTP GET request messages did your browser send? To which Internet
addresses were these GET requests sent?
 2 Get request

2. Can you tell whether your browser downloaded the two images serially, or whether they were
downloaded from the two websites in parallel? Explain.
Serially downloaded as first pearson downloaded then favicon image downloaded

DNS Analysis using wireshark:

Nslookup:

Run nslookup to obtain the IP address of a Web server in Asia. What is the IP
address of that server?

2. Run nslookup to determine the authoritative DNS servers for a university in

Europe?
3. Run nslookup so that one of the DNS servers obtained in Question 2 is
queried for the mail servers for Yahoo! mail. What is its IP address?

Tracing DNS with Wireshark:

1) Locate the DNS query and response messages. Are then sent over UDP or
TCP?

2) What is the destination port for the DNS query message? What is the source
port of DNS response
Message?
Source Port: 443
Destination Port: 17395

3) To what IP address is the DNS query message sent? Use ipconfig to

determine the IP address of your
local DNS server. Are these two IP addresses the same?
4) Examine the DNS query message. What “Type” of DNS query is it? Does the
query message contain
any “answers”?
5) Examine the DNS response message. How many “answers” are provided?
What do each of these
answers contain?

A First Look at The Captured Trace:

1. What is the IP address and TCP port number used by the client computer
(source) that is transferring the file to gaia.cs.umass.edu? To answer this
question, it’s probably easiest to select an HTTP message and explore the
details of the TCP packet used to carry this HTTP message, using the “details of
the selected packet header window”.

Source Address: 192.168.1.109

Source Port : 2538
2. What is the IP address of gaia.cs.umass.edu? On what port number is it
sending and receiving TCP segments for this connection?

Destination Address: 128.119.245.12

Source Port : 80

Task 8:
1. What is the sequence number of the TCP SYN segment that is used to initiate
the TCP connection between the client computer and gaia.cs.umass.edu? What
is it in the segment that identifies the segment as a SYN segment?

2. What is the sequence number of the SYNACK segment sent by

gaia.cs.umass.edu to the client computer in reply to the SYN? What is the value
of the Acknowledgement field in the SYNACK segment? How did
gaia.cs.umass.edu determine that value? What is it in the segment that identifies
the segment as a SYNACK segment?
 ● The message carries flags that show it to be a SYN ACK message.

3. What is the sequence number of the TCP segment containing the HTTP POST
command? Note that
in order to find the POST command, you’ll need to dig into the packet content
field at the bottom of
the Wireshark window, looking for a segment with a “POST” within its DATA field.