陕师大 计算机网络实验6wireshark.doc

计算机网络实验报告 利用WireShark分析IP协议 计科一班熊思平 实验目的 利用wireshark分析ip协议，学习了解ip数据包。 学习ip报文段的各领域。 实验器材 接入Internet的计算机主机； 抓包工具wireshark和截图工具snagit。 三、实验内容 1. Select the first ICMP Echo Request message sent by your computer, and expand the Internet Protocol part of the packet in the packet details window. What is the IP address of your computer? 实验结果如下： 2. Within the IP packet header, what is the value in the upper layer protocol field? 答：the upper layer protocol field is 1 实验结果如下： 3. How many bytes are in the IP header? How many bytes are in the payload of the IP datagram? Explain how you determined the number of payload bytes. 答：56-20=36就是有效载荷的长度，即此IP数据报的有效载荷为36字节 实验结果如下： 4. Has this IP datagram been fragmented? Explain how you determined whether or not the datagram has been fragmented. 答：没有分片，原因：flag 和 offset都为0； 实验结果如下如： 5. Which fields in the IP datagram always change from one datagram to the next within this series of ICMP messages sent by your computer? 答：分析结果之TTL,首部检验和，标识等一直在不断地变化。 6. Which fields stay constant? Which of the fields must stay constant? Which fields must change? Why? 答：分析可知： stay constant：版本号 首部长度，服务类型，标志，偏移，上层协议，目的和源IP地址 must stay constant：必须保持不变的是：版本号 源和目的IP地址 must change：标识，首部检验和 7. Describe the pattern you see in the values in the Identification field of the IP Datagram 答：the pattern is：每一个IP数据报头部的标识号域都不一样，每次加一 8. What is the value in the Identification field and the TTL field? 答： the value in the Identification field ：25603 the TTL field：254 9. Do these values remain unchanged for all of the ICMP TTL-exceeded replies sent to your computer by the nearest (first hop) router? Why? 答：每一个固定的路由器都有一个固定的TTL值，所以最近的那个路由器回复的所有的ICMP TTL-exceeded 的TTL的值都不会改变。 11. Print out the first fragment of the fragmented IP datagram. What information in the IP header indicates that the datagram been fragmented? What information in the IP header indicates whether this is the first fragment versus a latter fragment? How long is this IP datagram? 答：如截图，数据报大小改为2000后，开始