Guide to TCP/IP: IPv6 and IPv4, Fifth Edition
ISBN 978-1-305-94695-8
Chapter 9 Solutions
Answers to Review Questions
2. a, b, c, e
4. c
6. d
8. False
10. b, c
12. c
14. b
16. d
18. b
20. c
22. b
Hands-On Projects Discussion
Hands-On Project 9-1
In this project, the students examine the UDP header contained a DNS packet. You can either prepare the capture
file prior to class using Wireshark or have the students capture the data live on the network. If you choose the
latter option, students will need to have an FTP client such as Filezilla (http://filezilla-project.org/) installed on
their computers and you will need to direct the students to an FTP server, either one you have prepared on the
local network or one available on the Internet.
The following are answers to the questions about Step 8:
8a. What type of source port is used in this communication?
8b. What is the destination port used in this communication?
Port 53.
8c. What is the length of the UDP header?
8d. How can you determine the upper-layer protocol being used by the destination port information?
The students are instructed to save the capture to a trace file, which they can refer to in the future for practice or
Guide to TCP/IP: IPv6 and IPv4, Fifth Edition
ISBN 978-1-305-94695-8
Hands-On Project 9-2
This activity requires that you make available the ch09_6to4.pcapng file you acquired from the publisher as part of
the class materials for this book. The capture file is a sample of IPv6 traffic across an IPv6 network and the TCP
upper-layer protocol is providing transport for both versions of IP. Make sure the students can easily locate this
capture file.
The following are answers to the questions in this project:
6a. What is the source port for TCP and what protocol type is using TCP for transport?
6b. What is the destination port and what does the port number indicate?
6c. What is the acknowledgement number that is expected from the destination by the source?
6d. What is the header length?
8. With IPv6 selected and expanded, has the data under TCP that you previously examined changed? If so, how
has it changed and if now, why has it not changed?
Hands-On Project 9-3
In this project, the students focus on the TCP handshake process in the ch09_TCP-handshake.pcapng file. Students
examine Packets 8, 9, and 10, which represent the TCP handshake process.
The following are answers to the questions about Packet #8:
4a. What field under Internet Protocol Version 4 indicates that this is a TCP-based communication?
4b. What type of source port is used in this communication?
The port number is 51864 and is a dynamic source port used to facilitate this communication. Sometimes, students
4c. What is the length of the TCP header?
4d. What is the relative sequence number used by the source?
4e. What is the window size value?
Guide to TCP/IP: IPv6 and IPv4, Fifth Edition
ISBN 978-1-305-94695-8
The following are answers to the questions about Packet #9:
5a. What is the relative ACK number used by the sender of Packet 9?
5b. Do both sides of this communication use the same MSS?
The following are answers to the questions about Packet #10:
6a. Did this handshake complete properly?
Yes. The three-way handshake completed properly. In the Info column in the Wireshark packet list pane (top pane)
6b. What is the length of this TCP header?
6c. Are any TCP options defined in this packet?
6d. What is the calculated window size?
Case Projects Discussion
Case Project 9-1
In this case project, students should explore Wireshark to locate information on the applications crossing the wire.
It is extremely important to document the applications—this information is used to plan firewalls and locate any
Case Project 9-2
In this project, students should pick up the fact that the port numbers seen may be dynamic port numbers. They are
Case Project 9-3
In this project, the students are presented with a window size problem. Ideally, a communication uses a larger
window because it provides a more efficient and faster transfer of data across the network. There are several
reasons why a communication might use a small window size:
• The receiver’s TCP buffer is nearly full so it advertised a small window.
Guide to TCP/IP: IPv6 and IPv4, Fifth Edition
ISBN 978-1-305-94695-8
• Check to see if the receiver ever advertises a window size of zero. This is a definite indication that the
receiver’s TCP buffer is nearly full so it advertised a small window.
• Check to see if the window size gradually increases (Congestion Avoidance algorithm), and then
Case Project 9-4
In this project, the students examine the cause of duplicate ACKs on the network. Duplicate ACKs are a sign that
data sent to the shipping rates server are arriving out of order from the various e–commerce servers. This may be
caused by actual out-of-order packets, or by intermittent packet loss, which gives the appearance of packets