Unlock document.
This document is partially blurred.
Unlock all pages and 1 million more documents.
Get Access
Wireshark Lab: Ethernet &
ARP SOLUTION
Supplement to Computer Networking: A Top-Down
Approach, 6th ed., J.F. Kurose and K.W. Ross
©2013 Pearson Education, Inc. Upper Saddle River, NJ. All Rights Reserved.
1. What is the 48-bit Ethernet address of your computer? The Ethernet address of my
2. What is the 48-bit destination address in the Ethernet frame? Is this the Ethernet
address of gaia.cs.umass.edu? (Hint: the answer is no). What device has this as its
Ethernet address? [Note: this is an important question, and one that students
3. Give the hexadecimal value for the two-byte Frame type field. What upper layer
protocol does this correspond to? The hex value for the Frame type field is
4. How many bytes from the very start of the Ethernet frame does the ASCII “G” in
“GET” appear in the Ethernet frame? The ASCII “G” appears 52 bytes from the
Here is a screenshot of the Ethernet frame containing the HTTP OK response:
5. What is the value of the Ethernet source address? Is this the address of your
computer, or of gaia.cs.umass.edu (Hint: the answer is no). What device has this
as its Ethernet address? The source address 00:0c:41:45:90:a8 is neither the
6. What is the destination address in the Ethernet frame? Is this the Ethernet address
of your computer? The destination address 00:09:5b:61:8e:6d is the address of
7. Give the hexadecimal value for the two-byte Frame type field. What do the bit(s)
whose value is 1 mean within the flag field? The hex value for the Frame type
8. How many bytes from the very start of the Ethernet frame does the ASCII “O” in
“OK” (i.e., the HTTP response code) appear in the Ethernet frame? The ASCII
9. Write down the contents of your computer’s ARP cache. What is the meaning of
each column value? The Internet Address column contains the IP address, the
10. What are the hexadecimal values for the source and destination addresses in the
Ethernet frame containing the ARP request message? The hex value for the source
11. Give the hexadecimal value for the two-byte Ethernet Frame type field. What do
the bit(s) whose value is 1 mean within the flag field? The hex value for the
12. Download the ARP specification from ftp://ftp.rfc-editor.org/innotes/std/std37.txt.
A readable, detailed discussion of ARP is also at
http://www.erg.abdn.ac.uk/users/gorry/course/inet-pages/arp.html.
a) How many bytes from the very beginning of the Ethernet frame does the
b) What is the value of the opcode field within the ARP-payload part of the
c) Does the ARP message contain the IP address of the sender? Yes, the ARP
message containing the IP address 192.168.1.105 for the sender.
d) Where in the ARP request does the “question” appear – the Ethernet
address of the machine whose corresponding IP address is being queried?
Here is the screenshot for the ARP reply message:
13. Now find the ARP reply that was sent in response to the ARP request.
a) How many bytes from the very beginning of the Ethernet frame does the
b) What is the value of the opcode field within the ARP-payload part of the
Ethernet frame in which an ARP response is made? The hex value for
opcode field withing the ARP-payload of the request is 0x0002, for reply.
c) Where in the ARP message does the “answer” to the earlier ARP request
appear – the IP address of the machine having the Ethernet address whose
14. What are the hexadecimal values for the source and destination addresses in the
Ethernet frame containing the ARP reply message? The hex value for the source
15. Open the ethernet-ethereal-trace-1 trace file in
http://gaia.cs.umass.edu/wireshark-labs/wireshark-traces.zip. The first and second
ARP packets in this trace correspond to an ARP request sent by the computer
running Wireshark, and the ARP reply sent to the computer running Wireshark by
the computer with the ARP-requested Ethernet address. But there is yet another
computer on this network, as indicated by packet 6 – another ARP request. Why
