Using Wireshark

Set wireshark to capture mode

3. Bring up a command prompt in Windows (CMD.EXE) or terminal window in Linux.

Connect to USF FTP

server: ftp ftp.usf.edu

username: anonymous

password: abc@def.com

dir

d images

Get USFheader.png

close

quit

4. Wait a few seconds. Reconnect. ftp ftp.usf.edu username: anonymous password: abc@def.com dir cd images Get USFheader.png Close the terminal session without quitting FTP.

5. Wait a few seconds. In a browser, connect to ftp://ftp.usf.edu Click on images Click on USFheader.png Close the browser tab.

6. Wait a few seconds. Stop the Wireshark packet capture (pcap)

7. Go into the pcap and trace the TCP stream for the first connection. Show the 3-way handshake, flags and ack/seq #'s. Trace the Ack/Seq #'s for all of the packets of the stream. Present in an intelligible format (i.e., try to show the arithmetic, not just a bunch of screen shots).

8. Locate the packets where USFheader.png is actually transferred. Looking only at the Layer 3 packets, follow the Layer 3 fragmentation and ID. Was there any fragmentation? How do you know?

9. Trace the shut down flags and ack/seq #'s for the first connection.

10. Repeat 7-9 for the second connection. Especially look at the last 6 packets, flags and seq/ack #'s from the connection. What does the shutdown look like compared to #9?

11. Repeat 7-9 for the third connection. What does the shutdown look like compared to #9 and #10?

12. What did you notice about the userid and password captured from the three TCP streams?