陕师大 计算机网络实验6wireshark.doc

计算机网络实验报告利用WireShark分析IP协议 计科一班 41112009 熊思平1、 实验目的1. 利用wireshark分析ip协议，学习了解ip数据包。2. 学习ip报文段的各领域。2、 实验器材1. 接入Internet的计算机主机；2. 抓包工具wireshark和截图工具snagit。三、实验内容1. Select the first ICMP Echo Request message sent by your computer, and expandthe Internet Protocol part of the packet in the packet details window. What is the IP address of your computer?实验结果如下：2. Within the IP packet header, what is the value in the upper layer protocol field?答：the upper layer protocol field is 1实验结果如下：3. How many bytes are in the IP header? How many bytes are in the payload of theIP datagram? Explain how you determined the number of payload bytes.答：56-20=36就是有效载荷的长度，即此IP数据报的有效载荷为36字节实验结果如下：4. Has this IP datagram been fragmented? Explain how you determined whether ornot the datagram has been fragmented.答：没有分片，原因：flag 和 offset都为0；实验结果如下如：5. Which fields in the IP datagram always change from one datagram to the nextwithin this series of ICMP messages sent by your computer?答：分析结果之TTL,首部检验和，标识等一直在不断地变化。6. Which fields stay constant? Which of the fields must stay constant? Which fieldsmust change? Why?答：分析可知：stay constant：版本号 首部长度，服务类型，标志，偏移，上层协议，目的和源IP地址must stay constant：必须保持不变的是：版本号 源和目的IP地址must change：标识，首部检验和7. Describe the pattern you see in the values in the Identification field of the IPDatagram答：the pattern is：每一个IP数据报头部的标识号域都不一样，每次加一8. What is the value in the Identification field and the TTL field?答：the value in the Identification field ：25603the TTL field：2549. Do these values remain unchanged for all of the ICMP TTL-exceeded replies sentto your computer by the nearest (first hop) router? Why?答：每一个固定的路由器都有一个固定的TTL值，所以最近的那个路由器回复的所有的ICMP TTL-exceeded 的TTL的值都不会改变。11. Print out the first fragment of the fragmented IP datagram. What information inthe IP header indicates that the datagram been fragmented? What information inthe IP header indicates whether this is the first fragment versus a latter fragment?How long is this IP datagram?答：如截图，数据报大小改为2000后，开始分片。12. Print out the second fragment of the fragmented IP datagram. What information inthe IP header indicates that this is not the first datagram fragment? Are the morefragments? How can you tell?答：由以上接入可知：这个IP数据报的长度为1500+520-20=2000bytes，从 这片的片内偏移量不为零可以看出这不是第一片没有更多的分片，因为这片的标志位已经是0。13. What fields change in the IP header between the first and second fragment?答：改变的头部字段有：Total Length ，Flags，Fragment offset，Head checksum等14. How many fragments were created from the original datagram?答：分析可知，3 fragments were created from the original datagram。15. What fields change in the IP hea