QUESTION 1 115 marks] Refer to the following Wireshark capture. No Destination Protocol 10.000000 192-168-24-16 00-168-0 win-32120 Len HSS-1460 50678 [SYN, ACK Seq 20.001695 100.168-0- 92.168.24-16 Ack-1 Win-17376 Len- 50678 23 [ACK Seq-i Ack-1 Win-32120 Len-0- 30.001739 192-168-14-16 40.013040 192-168.14-1 5 0.150243100.168.0. 60.1551 192-168-14.16 00-168.0- 100-168.0.4 192.168.14-16 100.168-0-4 Al Data Al A1 P1 Al Data 0678 Al [ACK) Seq-28 Ack 4 Win-32120 Len-0 Who has 192.168.1.12 Tel 192.168.2.2 192-168.1-1 is at 70.150496 Barca 01:bdBroadcast 8 0.151908 Porto 00:34:56 Silicom 01 :6e bd ARP 90.152486 192.168.1.2 ARPho 00:30354:00:34:56 Standard query Oxedd4 A ftp.ecitele.com Standard query response Oxedd4 CRAME dns prime.com A 47-234.1-253 92.168-1.1 DNS DNS 10.153265 192.168.1.1 11 0.154151 192.168.1-2 12 0.154822 147-234-2-244 192.168-1-2 47.234.1.244 A2 Win-16384 Len O HSS-1460 21> ghetto [sY, ACK] Seq Ack-1 win 25398 Len-0 92.168.1-2 47.234-1-244 92-168.1-2 212.242.33.35 92.168.1.2 192-168.1. 92.168.2.2 A2 ghetto 21 [ACK] Seq-1 Ack-1 vin 16932 Len-o A2 13 0.155600192.168.1.2 14 0.156489192.168.1- DNS Standard query Oxbdds RV sip. udp.sip.cybercity.dk Request: REGISTER sip:sip.fullamark.in SIP 150.157157 192.168.1.2 16 0.1579 361 212.242.33 .35 17 0.158714192.168.1-2 P Status 401 Unauthorized bindi Echo (ping) request ICHP (id-0x0200, seq(be/le)-2304/9 Echo (ping) reply (id-0x0200, seqtbe/le) 2304/9 tt1-128) 0.159493 192-168-1- Echo (ping) request 0.160211192.168-1-2 92-168-1 ICHP (id-0x0200 be/1e)-2560/10 ttl-120 92-168.1.2 1CMP Eeho (ping) reply (Ld-0x0200, 20 10.1610871 192.168.1.1 seqtbe/le) 2304/9 tt1-128) Figure 1: Wireshark capture (a) Lines 1 to 6 show a running application (i) State the IP addresses for both source and destination respectively. 12 marks ii) What is protocol T? (i) Discuss the significance of TI when running with the application A1.12 marks] mark b) Protocol A2 is captured in sequence from Lines 11 to 13 i Determine the protocol based on the capture 2 marks ii) Verify the state of the application process by means of the conversation tracking 3 marks numbers. (c) The capture from Lines 17 to 20 is on Internet Control Message Protocol (CMP) Echo (ping) request (d-0x0200, seq(be/1e)-2304/9 tt1-0 The above capture shows the content of an ICMP request. What will the router do upon receiving one? 2 marks () A network engineer is testing on the connectivity of the network by executing ping' command. However, the reply returns were unreachable from the third and the fourth standard capture line. Elaborate on the troubleshooting procedure 3 marks for this
