Network protocol analysis experiment finishing

This experiment uses a network configuration, the host IP address 172.16.0.0 segment. Two pairs, each group to submit electronic reports.

This course requires an experiment in class and then write the report, the last open-book exam, here is my sort of problem, the corresponding answer in the PDF, 25 too many, there is need for self-created it

Link: https: //pan.baidu.com/s/1Gq0TM5lgZ5CgAItHqOaklA 
extraction code: l3x4 
copy the contents of this open Baidu network disk phone App, the operation more convenient oh

1. And the length of the LLC frame header (destination MAC-6, the source MAC-6, protocol type or data length -2)
2. The actual length of the Ethernet frame header: the header of the LLC frame 14 + 4 byte CRC
3. Compare SAP meaning control field three LLC frames
4. Protocol type or data length field mean? If this field is> 0600H (1536 in decimal), indicates the protocol type, less than, data indicating the length of the latter, so that in Experiment 1, the field is 0040, indicating the data length of the back 60 (64-4,4 bit LLC. header length)
5. Objective MAC LLC frame is broadcast FFFFFFF-FFFFFF
6. Different IP address and MAC address: bits, protocol, assignment based on the protocol layer different
7. IPconfig command to check the machine IP, MAC, DNS, gateway, MASK
8. See route print native routing table: table entry comprises: the IP object, netmask, gateway, an output interface Interface, the path length METRIC
9. This machine is the default route in the routing table: Network Destination of 0.0.0.0
10. IP protocol header fields and the meaning (sixteen mechanism will give an Ethernet frame byte information, it determines the protocol type, IP address, port, etc.), the total length of the IP packet header length = data length 20Byte +
11. Protocol type, data length field used Value (hex): 0800: IP protocol 8600: IPV6 protocol 0806: ARP protocol
    1. Common high-level protocol type value (hex) IP protocol: ICMP: 01 IGMP: 02 TCP06 UDP: 11 OSPF: 59
    2. Experiment Question 2: View of the captured frame length is how many? It is consistent with the length of the message editor? Inconsistent, because the IP packet after encapsulation, capture the frame length 14 is the length of the total length of the IP packet frames + LLC
    3. Experiment 2 Question: Why has the destination port unreachable message: edit the package because no transport layer, no process receives, so ...
    4. IPV6 and IPV4 difference, the corresponding field? (NextHeader TTL HopLimit)
    5. IP broadcast
    6. IP fragmentation (emphasis): IP fragmentation of this experiment is to use PIng achieve, due to the principle Ping is the use of ICMP query messages, there is an 8-byte ICMP header in the IP data portion, therefore, the entire data section ping is the number of bytes + 8 bytes, if ping3000, sliced ​​into (3000 + 8) / 3 = 1480, a last IP data length of 3008-1480 * 2 = 48, IP packets total length is 48 + 20 = 68 bytes, a total length of the last frame is 82
    7. IP fragment (ping), ping how long to keep the last frame is 82 bytes? 1480 * n + 40
    8. netstat command: -s shows the machine has been accepted and the number of IP packets transmitted -r: shows the routing tables
    9. -e: View Ethernet statistics
    10. arp -a to view the contents of the cache table
    11. ARP Request message header: MAC layer -ARP layer
    12. Different network sends ARP packets principle (spoken computer network), during which the same IP packet, the MAC is changed, TTL change (number of gateways through the reaction)
    13. ARP spoofing principle
    14. IP conflict principle: free ARP (ARP inquiry packet, the source and destination IP are their own IP)
    15. The role of the ARP cache: reducing the number of broadcasts sent, improve parsing speed
    16. Why ARP entries over time, would disappear? It has aging mechanism
    17. ICMP packet types and formats, codes, carried in the IP layer protocol
    18. ICMP timestamp packets and response packets format
    19. Compare and ICMPV4 of ICMPV6
    20. ICMP redirect (what characteristics data?)
    21. UDP checksum fill 0, which means no check
    22. Manually calculate UDP packet format and checksum
    23. UDP port is not up, generate ICMP error messages
    24. UDP limited broadcast and direct broadcasting, the difference between the two
    25. DNS: nslookup domain DNS message edition (forward and reverse lookup queries)
    26. Changes in TCP three-way handshake sequence number and acknowledgment number
    27. TCP connection release changes
    28. TCP experiments, the host sends a reply message, whether to capture two consecutive response packet, the ACK and the former than the latter? Will, it is possible for the first ACK packet is lost, the recipient retransmission timeout led to the subsequent arrival
    29. UDP port scan
    30. TCP port scan SYN (RST representative Close, SYN / ACK representatives open), FIN scans (unix: Close restore RST, windows: all replies RST)
    31. FTP command, port, etc., the PORT effect, control and data connections
    32. HTTP protocol
    33. DHCP four phases
    34. DHCP message format
    35. SMTP protocol