《实验三：网络协议的分析》由会员分享，可在线阅读，更多相关《实验三：网络协议的分析（7页珍藏版）》请在金锄头文库上搜索。
1、实验三：网络协议的分析、 实验目的：1. 掌握使用 Wireshark 分析各种网络协议的技能；2. 深入理解应用层协议HTTP和FTP的工作过程，及协议内容;二、实验环境：1. 运行 Windows 2000 / 2003 Server / XP 操作系统的 PC 一台；2. 每台PC具有一块以太网卡，通过双绞线与局域网相连；3. Wireshark 安装程序（可以从 http:/www.wireshark.org/下载）。三、实验内容与要求：1. 参照附件一：了解网络协议分析仪Wireshark，完成Wireshark的安装和基本使用。2. 捕获 ICMP 数据包运行程序，单击CAPTUR
2、E菜单下的start命令，开始捕获数据包。然后输入过滤条件为 只捕获 ICMP 协议的数据包。如下图所示。Vireshark 1.8.3 (SK Rev 45256 fro /trunk-1.8)File Edit View Go Capture Analyze Statistics T elephony Tools Internals Help594 0 2 5 5.267201 172.16. 67.189lies t izti onV Expression. . . Clea Apply EaveProtocol Length Info一239.255.255.250SSDP174 M-
3、SEARCH 百 HTTF/l.lA-5949 256.710367 172.16.65.935950 2 56.710484 172.16. 65.935951 256.710605 172.16. 65.935952 2 56. 710611 172.16. 65.935953 256.710651 172.16.65.935955 2 57.189606 172.16. 75.925956 257.189625 172.16. 75.925957 257.189637 172.16. 75.925958 257.189651 172.16. 75.925959 257.189681 17
4、2.16. 75.925960 2 57. 264 029 172.16. 67.1895961 2 57. 2643 76 172.16. 67.1895972 2 59. 269173 172.16. 67.1895973 2 59. 270098 172.16. 67.189239.255.255.250239.255.255.250239.255.255.250239.255.255.250239.255.255.250239.255.255.250239.255.255.250239.255.255.250239.255.255.250239.255.255.250239.255.2
5、55.250239.255.255.250239.255.255.250239.255.255.250SSDPS5DPSSDPS5DPSSDPS5DPSSDPS5DPSSDPS5DPSSDPS5DPSSDPS5DP175 M-5EARCH * HTTP/1.1174 M-SEARCH * HTTP/1.1179 M-SEARCH * HTTP/1.1143 M-SEARCH * HTTP/1.1143 M-SEARCH * HTTP/1.1175 M-SEARCH * HTTP/1.1174 M-SEARCH * HTTP/1.1179 M-SEARCH * HTTP/1.1143 M-SEA
6、RCH * HTTP/1.1143 M-SEARCH * HTTP/1.1175 M-SEARCH * HTTP/1.1174 M-SEARCH * HTTP/1.1175 M-SEARCH * HTTP/1.1174 M-SEARCH * HTTP/1.1田 Frame 5940: 174 bytes on wire (1392 bits), 174 bytes Cdptured (1392 bits) on 1 nr erface 1人C. A：. XM SE.A.R. CH 百 HTT F/l.l. . H O5T: 239 .255.255o M 2 CO 5 0-15435 f 1
7、_d 54 p- 4 o 3 0-05-02 o b 4 o 38 3 3 1 E0 4 5 3 2o od e 56 12 2 3 c cd 1 55 3 4 3 3 o e sf 21 c 7 2 36 6f o e_9 c c 5 24 1 c 4 0- ols 5 3 0 3 0 4 3 0 0 0 5 3 a o c s 2 f o 6 4 3 f o 7 o oo o 2 2 f 7 8 a a 7b723 p- o 3 o 45 1 LJJ 2 5 o o -d s 3 ordM 4 5 1 of 3f o of 4 40000001000200030004 0+ Etherne
8、t II, sru: ExtremeN_10:5c:60 C00:04:96:10:5c:60), Dst: lPv4mcast_7f:ff:fa C01:00:5e: + internet Protocol Version 4, Src: 172.16.67.189 (172.16.67.189), Dst: 239.255.255.250 C239. + user Datagram Protocol, src Port: 58232 C58232-), Dst Port: ssdp C1900-)然后在命令行模式下ping其他同学的电脑。就可以看到捕获区域有捕获到的ICMP的数据包了。对该
9、数据包进行分析。Realtek RTL8139/81 Ox Faily Fast Ethernet NIC(Kicrosoft* s Packet Scheduler)File Edit View Go Capture Analyze Statistics Telepho ny Tools Internals Help副攵曲除眼丄自启銘窈Q硼瞪令吾殳丨I團亘I産1葩船丨色Filter：learApplySavei cmpV Expressi on.No.TimeSourceDestinationProtocolLencthInfo45；20. 2387630 192.168. 2.11192.
10、168.2.6ICMP74Echo(ping)request1d=0x0200,seq=2304/9,ttl=644620. 2388900 192.168.2.6192.16&2.ICMP74Echo(ping)replyid0x0200,seq=2304/9,ttl=645021. 2290950 192.16& 2.192.168.2.6ICMP74Echo(ping)requestid0x0200,seq=2560/10,TT1=645121.2292610 192.168.2.6192.168.2.11ICMP74Echo(ping)replyid0x0200,seq=2560/10
11、,ttl=645822. 2290990 192.168.2.11192.168.2.6ICMP74Echo(ping)request-id0x0200,seq=2816/ll,TT1=645922.2292770 192.168.2.6192.168.2.11ICMP74 Echo (ping)replyid0x0200,seq=2816/ll,ttl=646223. 2291540 192.168.2.11192.168.2.6ICMP74Echo(ping)requestid0x0200,seq=3072/12,TT1=646323.2293200 192.168.2.6192.168.
12、2.11ICMP74Echo(ping)replyid0x0200,seq=3072/12,ttl=64田 Frame 45: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0田 Ethernet II, Src: Realtek5_54:90:00 (00:eO:4c:54:90:00), Dst: Realtek5_61:2f:98 (00:eO:4c:61:2f:98) j internet Protocol version 4, src: 192.168. 2.11 (192.168. 2.
13、11), Dst: 192.168. 2. 6 (192.168. 2. 6) 田 Internet Control Message Protocol000000eO4c612f9800eO4c54900008004500i .a *LT.E.0010003c4d6400004001a?fbCOa8020bCOa8.Md.t OKS002002060800425c02000900616263646566.B.abcdef(44% J00306768696a6b6c6d6f70717273747576ghi jklmnopqrstuv0040y y616263646566676S69wabcde
14、fghiO 制 File: CADOCUME-iyADMINI-lVLOCALS-.? Packets: 72 Displayed: 8 Marked: 0 Drop.? Profile: Default源IP地址192.168.2.11目的IP地址192.168.2.6是否ping通？是生存时间643. 捕获HTTP数据包运行程序，单击CAPTURE菜单下的start命令，开始捕获数据包。然后输入过滤条件为只捕获http协议的数据包。然后打开IE浏览器，访问一些网页。就可以看到捕获区域有捕获到的 http 的数据包了。选取连续的两个数据包，并对这两个数据包进行分析。源端口号1711目的端口号80源IP地址192.168.2.11目的IP地址202.196.16.2源
