Homework 1: Practice with Tcpdump
Due: Tue, Aug 31 via email
In this assignment you will get some practice using
tcpdump. Download the file test.pcap
and use tcpdump to answer the
following questions. In the file, there is one large file transfer.
did the transfer start? When did it end? The ssh connection started at
19:14:39.197043, when the first SYN packet is seen to host
18.104.22.168 (taylor.cs.colostate.edu). The actual data most likely
started at 19:14:40.129621 when the first packet of size 1440 is seen.
Note that the MTU negotiated earlier was 1460. The data transfer most
likely ended at 19:14:43.367989, when a packet of size 464 bytes was
transfered. There was a number of small packets transfered after that,
which are most likely SSH related data. The TCP connection ended at
19:14:43.546753 when the ack for the last FIN was received.
was the size of the data transfered? This can be obtained from the sequence
numbers of the SYN and FIN packets. However, tcpdump makes it easy for
you to find this because it shows the offset from the initial sequence
number. Thus, the final amount of data transfered is 3047767, which
appears in the FIN packet at 19:14:43.546702. Given that the size of
the file was 3029296 bytes, the rest is ssh related data.
was the average roundtrip time? Argus reports 0.013865 secs RTT.
many packets were transfered? Argus
reports 2171 from source to destination, 3305 total packets.
was the data packet size? Looking
at the tcpdump output, most large packets were 1440 bytes.
was the window size on each endpoint? Looking at tcpdump, swin was 10816B and
dstwin 50400B. Note that you may see a different number in the tcpdump
output, for example you will see win 169 for the source host. The
reason is that in the original SYN packet the hosts negotiated window
scaling (wscale 6), so you have to multiply the window value seen in
the packet by 6 * 8 = 64B (window scaling is negotiated in multiples of
8 bytes). Argus reports the correct window fo you. Why then, does the
server reports an unscaled window size? Because window scaling (wscale)
was 0 in the syn-ack.
was the average transfer rate? Argus
reports 6028799 b/s.