Homework 1 -- Using Ethereal

Computer Networks
Spring, 2005
Due:  February 21

This homework involves using Ethereal to see the packets exchanged while running some network programs.

Part One.  Echo Client and Server (stream version)

You need to download and compile the echo client and server source files:  tcpEchoClient.c  tcpEchoServer.c

1.  Log in to one of the linux machines.  In one terminal window, start up an ssh session logged into another machine.  Run the echo server on the remote machine.

2.  In another terminal window, start up Ethereal using the command "sudo ethereal &".  You should see a GUI application that looks like this:




In the "Filter" text field, enter the following:

ip.addr==<ip address of remote machine> && tcp.port==5193

This will select only those packets related to the echo client and server interaction.

3.  Start packet capture by clicking the "Start" option from the pull-down "Capture" menu.

There are lots of checkboxes here, but you can use the defaults in most cases.  Make sure that the box labeled "Capture packets in promiscuous mode" is checked.  Another checkbox gives you the option of updating the capture window in real time.  The alternative is to display packets only after capturing has stopped.  Either way works fine.

4.  Now back in your local terminal window, start the echo client, giving the address of the remote machine as its parameter.  Enter three short phrases and see that they are echoed by the server.  Then use control-D to indicate end-of-file.

5.  Stop packet capture by clicking the "Stop" button in Ethereal's capture window.

Now answer the following questions:

1.  How many packets have been captured and caught by the filter?
2.  How many packets were sent from your local machine and how many from the remote machine?
3.  How many packets were used in setting up the TCP connection?  How many were used to send data?  How many contained only acknowledgments?  How many were used to tear down the TCP connection?
4.  What is the Ethernet address of the local machine?  What is the Ethernet address of the remote machine?
5.  Choose one of the data packets sent from the local machine to the remote machine.
a.  What was the text message you entered at the keyboard?
b.  How many bytes of application data are in the frame?  (That is, the string you entered at the keyboard.)
c.  How many bytes are in the TCP header?
d.  How many bytes are in the IP header?
e.  How many bytes are in the Ethernet header?
f.  What is the total number of bytes in the frame?

Part Two.  Echo Client and Server (datagram version)

Now run the datagram versions of the echo client and server and capture the packets using ethereal.  Download the files udpEchoClient.c and udpEchoServer.c

1.  Start up the datagram version of the echo server on a remote machine.

2.  Modify the "Filter" field by replacing "tcp.port" with "udp.port" as follows:

ip.addr==<ip address of remote machine> && udp.port==5193

3.  Start packet capture by clicking the "Start" option from the pull-down "Capture" menu.

4.  Now back in your local terminal window, start the echo client, giving the address of the remote machine as its parameter.  Enter three short phrases and see that they are echoed by the server.  Then use control-D to indicate end-of-file.

5.  Stop packet capture by clicking the "Stop" button in Ethereal's capture window.

Now answer the following questions:

1.  How many packets have been captured and caught by the filter?
2.  How many packets were sent from your local machine and how many from the remote machine?
3.  What is the Ethernet address of the local machine?  What is the Ethernet address of the remote machine?
4.  Choose one of the data packets sent from the local machine to the remote machine.
a.  What was the text message you entered at the keyboard?
b.  How many bytes of application data are in the frame?  (That is, the string you entered at the keyboard.)
c.  How many bytes are in the UDP header?
d.  How many bytes are in the IP header?
e.  How many bytes are in the Ethernet header?
f.  What is the total number of bytes in the frame?