Open Wireshark and set in capture mode 3. Bring up a command prompt in Windows (
ID: 3744428 • Letter: O
Question
Open Wireshark and set in capture mode
3. Bring up a command prompt in Windows (CMD.EXE) or terminal window in Linux.
Connect to USF FTP server: ftp ftp.usf.edu
username: anonymous
password: abc@def.com
dir
cd images
Get USFheader.png close quit
4. Wait a few seconds. Reconnect. ftp ftp.usf.edu username: anonymous password: abc@def.com dir cd images Get USFheader.png Close the terminal session without quitting FTP.
5. Wait a few seconds. In a browser, connect to ftp://ftp.usf.edu Click on images Click on USFheader.png Close the browser tab.
6. Wait a few seconds. Stop the Wireshark packet capture (pcap)
7. Go into the pcap and trace the TCP stream for the first connection. Show the 3-way handshake, flags and ack/seq #'s. Trace the Ack/Seq #'s for all of the packets of the stream. Present in an intelligible format (i.e., try to show the arithmetic, not just a bunch of screen shots).
8. Locate the packets where USFheader.png is actually transferred. Looking only at the Layer 3 packets, follow the Layer 3 fragmentation and ID. Was there any fragmentation? How do you know? If possible, make a diagram showing the various fragmentation flags, fragment offsets and assembled content. Note: If the underlying IP datagram is IPv6 and not IPv4, then Wireshark will not show the fragmentation flags, because IPv6 does not have fragmentation.
9. Trace the shut down flags and ack/seq #'s for the first connection.
10. Repeat 7-9 for the second connection. Especially look at the last 6 packets, flags and seq/ack #'s from the connection. What does the shutdown look like compared to #9?
11. Repeat 7-9 for the third connection. Especially look at the last 6 packets, flags and seq/ack #'s from the connection. What does the shutdown look like compared to #9 and #10?
12. What did you notice about the userid and password captured from the three TCP streams?
I understand all of this question besides what is being asked in number 12.
I do not understand what I am supposed to be noticing about the userid and password from the three streams
Explanation / Answer
Ok if you check the ip address of the ftpserver (ftp.usf.edu=>131.247.253.85) in wareshark as ip.addr == 131.247.253.85 and start trace you will see that the username and password are visible. And if you open the site from a browser it will take and auto password provided by browser eg for chrome it will be chrome@example.com.
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.