Relatório Wireshark LAB - HTTP-DNS

Prévia do material em texto

Wireshark Lab: HTTP 
 
1. The Basic HTTP GET/response interaction 
 
1. Is your browser running HTTP version 1.0 or 1.1? What version of HTTP 
is the server running? 
 
Meu browser e o servidor estão rodando HTTP 1.1. 
 
2. What languages (if any) does your browser indicate that it can accept to 
the server? 
 
Accept-language: pt-BR, pt; en-US, en. 
 
3. What is the IP address of your computer? Of the gaia.cs.umass.edu 
server? 
 
Meu IP: 192.168.1.102 
IP do servidor: 128.119.245.12 
 
4. What is the status code returned from the server to your browser? 
 
HTTP/1.1 200 OK 
 Request Version: HTTP/1.1 
 Status Code: 200 
 Response Phrase: OK 
 
5. When was the HTML file that you are retrieving last modified at the 
server? 
 
Last-Modified: Sun, 01 Apr 2012 14:01:01 GMT 
 
6. How many bytes of content are being returned to your browser? 
 
Content-Length: 128 
 
7. By inspecting the raw data in the packet content window, do you see 
any headers within the data that are not displayed in the packet-listing 
window? If so, name one. 
 
Não, todos os cabeçalhos estão no packet content. 
 
 
2. The HTTP CONDITIONAL GET/response interaction 
 
8. Inspect the contents of the first HTTP GET request from your browser 
to the server. Do you see an “IF-MODIFIED-SINCE” line in the HTTP 
GET? 
 
Não. 
 
9. Inspect the contents of the server response. Did the server explicitly 
return the contents of the file? How can you tell? 
 
Sim. No campo Line-based text data: text/html podemos ver o conteúdo da 
página. 
 
10. Now inspect the contents of the second HTTP GET request from your 
browser to the server. Do you see an “IF-MODIFIED-SINCE:” line in the 
HTTP GET? If so, what information follows the “IF-MODIFIED-SINCE:” 
header? 
 
Sim. If-Modified-Since: Sun, 01 Apr 2012 16:44:01 GMT 
 
11. What is the HTTP status code and phrase returned from the server in 
response to this second HTTP GET? Did the server explicitly return the 
contents of the file? Explain. 
 
HTTP/1.1 304 Not Modified 
 Request Version: HTTP/1.1 
 Status Code: 304 
 Response Phrase: Not Modified 
 
Como o conteúdo já está no cache do navegador, o servidor não retorna o 
conteúdo novamente. 
 
 
 
3. Retrieving Long Documents 
 
12. How many HTTP GET request messages were sent by your browser? 
 
Foi enviado um HTTP GET pelo navegador. 
 
13. How many data-containing TCP segments were needed to carry the 
single HTTP response? 
 
Foram necessários 4 segmentos de TCP para carregar a página. 
 
14. What is the status code and phrase associated with the response to the 
HTTP GET request? 
 
HTTP/1.1 200 OK 
 Request Version: HTTP/1.1 
 Status Code: 200 
 Response Phrase: OK 
 
15. Are there any HTTP status lines in the transmitted data associated with 
a TCP-induced “Continuation”? 
 
Não. 
 
4. HTML Documents with Embedded Objects 
 
16. How many HTTP GET request messages were sent by your browser? 
To which Internet addresses were these GET requests sent? 
 
Foram enviadas três requisições HTTP GET pelo navegador. 
Para os seguintes endereços: 
1) 128.119.245.12 
2) 165.193.140.14 
3) 128.119.240.90 
 
17. Can you tell whether your browser downloaded the two images serially, 
or whether they were downloaded from the two web sites in parallel? 
Explain. 
 
Cada imagem foi transmitida em uma conexão TCP diferente, logo são 
baixadas em série. 
 
 
5 HTTP Authentication 
 
18. What is the server’s response (status code and phrase) in response to 
the initial HTTP GET message from your browser? 
 
HTTP/1.1 401 Authorization Required 
 Request Version: HTTP/1.1 
 Status Code: 401 
 Response Phrase: Authorization Required 
 
19. When your browser’s sends the HTTP GET message for the second 
time, what new field is included in the HTTP GET message? 
 
Authorization: Basic d2lyZXNoYXJrLXN0dWRlbnRzOm5ldHdvcms= 
 Credentials: wireshark-students:network 
 
Wireshark Lab: DNS 
 
1 nslookup 
 
1. Run nslookup to obtain the IP address of a Web server in Asia. 
 
nslookup www.kantei.go.jp 
 
Servidor: DSLink260E.local.lan 
Address: 192.168.1.1 
 
Não é resposta de autorização: 
Nome: www.kantei.go.jp 
Address: 202.232.75.151 
 
2. Run nslookup to determine the authoritative DNS servers for a university 
in Europe. 
Testamos para University of Cambridge 
 
nslookup –type=NS cam.ac.uk 
 
Servidor: DSLink260E.local.lan 
Address: 192.168.1.1 
 
Não é resposta de autorização: 
cam.ac.uk nameserver = bitsy.mit.edu 
cam.ac.uk nameserver = authdns0.csx.cam.ac.uk 
cam.ac.uk nameserver = ns2.ic.ac.uk 
cam.ac.uk nameserver = dns0.eng.cam.ac.uk 
cam.ac.uk nameserver = authdns1.csx.cam.ac.uk 
cam.ac.uk nameserver = dns0.cl.cam.ac.uk 
cam.ac.uk nameserver = dns1.cl.cam.ac.uk 
 
ns2.ic.ac.uk internet address = 155.198.142.82 
bitsy.mit.edu internet address = 18.72.0.3 
 
 
3. Run nslookup so that one of the DNS servers obtained in Question 2 is 
queried for the mail servers for Yahoo! mail. 
 
nslookup mail.yahoo.com bitsy.mit.edu 
 
Servidor: BITSY.MIT.EDU 
Address: 18.72.0.3 
 
Não é resposta de autorização: 
Nome: login.lga1.b.yahoo.com 
Addresses: 98.139.241.94 
 209.191.92.114 
Aliases: mail.yahoo.com 
 login.yahoo.com 
 login-global.lgg1.b.yahoo.com 
 
 
 
2 ipconfig 
 
4. Locate the DNS query and response messages. Are then sent over UDP 
or TCP? 
 
Foram transmitidas com UDP. 
 
5. What is the destination port for the DNS query message? What is the 
source port of DNS response message? 
 
A porta de destino da mensagem de consulta DNS é 53. 
A porta de origem da mensagem de resposta DNS é 53. 
 
6. To what IP address is the DNS query message sent? Use ipconfig to 
determine the IP address of your local DNS server. Are these two IP 
addresses the same? 
 
A mensagem de consulta DNS é enviada para o IP 192.168.1.1 
Servidor DNS local: 192. 
Logo, são os mesmos endereços IP. 
 
7. Examine the DNS query message. What “Type” of DNS query is it? Does 
the query message contain any “answers”? 
 
Type: A (Host address) 
A mensagem de consulta não contém “answers”. 
 
 
8. Examine the DNS response message. How many “answers” are 
provided? What do each of these answers contain? 
 
Foi gerada uma resposta: 
 www.ietf.org: type A, class IN, addr 12.22.58.30 
A resposta contém: 
 Name: www.ietf.org 
 Type: A (Host address) 
 Class: IN (0x0001) 
 Time to live: 15 minutes, 26 seconds 
 Data length: 4 
 Addr: 12.22.58.30 (12.22.58.30) 
 
9. Consider the subsequent TCP SYN packet sent by your host. Does the 
destination IP address of the SYN packet correspond to any of the IP 
addresses provided in the DNS response message? 
 
Sim, o endereço IP de destino do pacote TCP SYN é o mesmo da mensagem 
de resposta DNS (12.22.58.30). 
 
10. This web page contains images. Before retrieving each image, does your 
host issue new DNS queries? 
 
Não. Pois há cache DNS de consulta anterior. 
 
 
 
 
Executando: nslookup www.mit.edu 
 
11. What is the destination port for the DNS query message? What is the 
source port of DNS response message? 
 
A porta de destino da mensagem de consulta DNS é 53. 
A porta de origem da mensagem de resposta DNS é 53. 
 
12. To what IP address is the DNS query message sent? Is this the IP 
address of your default local DNS server? 
 
A mensagem de consulta DNS é enviada para o endereço IP 192.168.1.1 
Este é o endereço IP do servidor DNS local. 
 
13. Examine the DNS query message. What “Type” of DNS query is it? Does 
the query message contain any “answers”? 
 
Type: A (Host address) 
A mensagem de consulta não contém “answers” 
 
 
14. Examine the DNS response message. How many “answers” are 
provided? What do each of these answerscontain? 
 
Foi gerada uma resposta: 
 www.mit.edu: type A, class IN, addr 18.9.22.169 
A resposta contém: 
 Name: www.mit.edu 
 Type: A (Host address) 
 Class: IN (0x0001) 
 Time to live: 1 minute 
 Data length: 4 
 Addr: 18.9.22.169 (18.9.22.169) 
 
 
15. Provide a screenshot. 
 
Mensagem de consulta DNS 
 
Mensagem de resposta DNS 
 
 
 
 
Executando: nslookup –type=NS mit.edu 
 
16. To what IP address is the DNS query message sent? Is this the IP 
address of your default local DNS server? 
 
A mensagem de consulta DNS é enviada para o endereço IP 192.168.1.1 
Este é o endereço IP do servidor DNS local 
 
17. Examine the DNS query message. What “Type” of DNS query is it? Does 
the query message contain any “answers”? 
 
Type: NS (Authoritative name server) 
A mensagem de consulta não contém “answers” 
 
18. Examine the DNS response message. What MIT nameservers does the 
response message provide? Does this response message also provide 
the IP addresses of the MIT namesers? 
 
mit.edu nameserver = STRAWB.mit.edu 
mit.edu nameserver = BITSY.mit.edu 
mit.edu nameserver = W20NS.mit.edu 
 
BITSY.mit.edu internet address = 18.72.0.3 
STRAWB.mit.edu internet address = 18.71.0.151 
W20NS.mit.edu internet address = 18.70.0.160 
 
 
19. Provide a screenshot. 
 
Mensagem de consulta DNS 
 
Mensagem de resposta DNS 
 
 
 
 
 
 
Executando: nslookup www.aiit.or.kr bitsy.mit.edu 
 
20. To what IP address is the DNS query message sent? Is this the IP 
address of your default local DNS server? If not, what does the IP 
address correspond to? 
 
A mensagem de consulta DNS foi enviada para o endereço IP 18.72.0.3 
Este não é o endereço IP do servidor DNS local (192.168.1.1). 
 
21. Examine the DNS query message. What “Type” of DNS query is it? Does 
the query message contain any “answers”? 
 
Type: A (Host address) 
A mensagem de consulta não contém “answers” 
 
22. Examine the DNS response message. How many “answers” are 
provided? What does each of these answers contain? 
 
Foi gerada uma resposta: 
 www.aiit.or.kr: type A, class IN, addr 121.254.171.27 
A resposta contém: 
 Name: www.aiit.or.kr 
 Type: A (Host address) 
 Class: IN (0x0001) 
 Time to live: 1 hour 
 Data length: 4 
 Addr: 121.254.171.27 (121.254.171.27) 
 
 
23. Provide a screenshot. 
 
Mensagem de consulta DNS 
 
 
Mensagem de resposta DNS