Answered step by step
Verified Expert Solution
Link Copied!

Question

1 Approved Answer

The program must be named Traceroute.java, and needs to take the file name of the tcpdump trace as the first argument. For example, the program

The program must be named "Traceroute.java", and needs to take the file name of the tcpdump trace as the first argument. For example, the program needs to run as $ javac Traceroute.java $ java Traceroute tcpdump.txt and the results of the analysis must be written on standard output (basically, on screen). NOTE: project submissions that do not follow the guidelines will be discarded wihtout consideration (i.e., 0 points). Project Description: In this project, you are required to write a program that takes in input a textual tcpdump trace of traffic generated by Traceroute and computes the time between a TCP packet sent by the client and the related ICMP "Time exceeded in-transit" message. As an example, consider the two packet logs reported below: 1291654312.963163 IP (tos 0x0, ttl 1, id 9067, offset 0, flags [none], proto TCP (6), length 60) 128.192.76.177.47212 > 137.138.144.168.80: S, cksum 0xc4d6 (correct), 1135826272:1135826272(0) win 5840 1291654312.963644 IP (tos 0xc0, ttl 255, id 2503, offset 0, flags [none], proto ICMP (1), length 56)128.192.76.129 > 128.192.76.177: ICMP time exceeded in-transit, length 36 IP (tos 0x0, ttl 1, id 9067, offset 0, flags [none], proto TCP (6), length 60) 128.192.76.177.47212 > 137.138.144.168.80: tcp 40 [bad hdr length 0 - too short, < 20] as we can see from the highlighted fields, the two packets are related to each other. The fields you should check to match a sent TCP packet with the related ICMP response are: id 9067, TCP,128.192.76.177.47212 > 137.138.144.168.80 Notice that these fields are replicated in the body of the ICMP message (in practice the IP ID field should be sufficient to correctly correlate the two packets). From the two packets above, the output should be: TTL 1 128.192.76.129 0.481 ms where 128.192.76.129 is the IP addresses of the router that generated the ICMP response, and 0.481 ms is computed as (1291654312.963644 - 1291654312.963163) * 1000 and rounding to obtain only three digits after the dot. As another example the output related to the following packets 1291654312.963267 IP (tos 0x0, ttl 3, id 9075, offset 0, flags [none], proto TCP (6), length 60) 128.192.76.177.56812 > 137.138.144.168.80: S, cksum 0x5834 (correct), 2778675862:2778675862(0) win 5840 1291654312.963655 IP (tos 0x0, ttl 62, id 47385, offset 0, flags [none], proto ICMP (1), length 56)128.192.254.49 > 128.192.76.177: ICMP time exceeded in-transit, length 36 IP (tos 0x0, ttl 1, id 9075, offset 0, flags [none], proto TCP (6), length 60) 128.192.76.177.56812 > 137.138.144.168.80: tcp 40 [bad hdr length 0 - too short, < 20] would be TTL 3 128.192.254.49 0.388 ms Consecutive TCP-ICMP packet pairs related to the same ICMP source IP should be listed without repeating the TTL value and IP string. For example, if there are 3 consecutive TCP-ICMP packet pairs related to TTL=3 and with ICMP packets originating from 128.192.254.49, you should list them as TTL 3 128.192.254.49 0.388 ms 0.401 ms 0.398 ms

Step by Step Solution

There are 3 Steps involved in it

Step: 1

blur-text-image

Get Instant Access to Expert-Tailored Solutions

See step-by-step solutions with expert insights and AI powered tools for academic success

Step: 2

blur-text-image

Step: 3

blur-text-image

Ace Your Homework with AI

Get the answers you need in no time with our AI-driven, step-by-step assistance

Get Started

Recommended Textbook for

Data Mining Concepts And Techniques

Authors: Jiawei Han, Micheline Kamber, Jian Pei

3rd Edition

0123814790, 9780123814791

More Books

Students also viewed these Databases questions

Question

What is our budget?

Answered: 1 week ago