CSC358 Wireshark Assignment 1 Solution Part I. UDP 1, Select one UDP packet from your trace. From this packet, determine how many fields there are in the UDP header. (You shouldn’t look in the textbook! Answer these questions directly from what you observe in the packet trace.) Name these fields. Solution: UDP header contains 4 fields: 1. source port; 2. destination port; 3. length; 4. checksum2. By consulting the displayed information in Wireshark’s packet content field for this packet, determine the length (in bytes) of each of the UDP header fields Solution: ‘The UDP header has a fixed length of 8 bytes. Each of these 4 header fields is 2 bytes long.3. The value in the Length field is the length of what? (You ean consult the text for this answer) ‘What is the length of UDP payload for your selected packet Solution: ‘The length field specifies the number of bytes in the UDP segment (header plus data). An explicit length value is needed since the size of the data field may differ from one UDP segment to the next. The length of UDP payload for selected packet is 32 bytes. 40 bytes - 8 bytes = 32 bytes4, What is the maximum number of bytes that can be included in a UDP payload? (Hint: the answer to this question can be determined by your answer to 2. above) Solution: ‘The maximum number of bytes that can be included in a UDP payload is (216 — 1) bytes plus the header bytes. This gives 65535 bytes — 8 bytes = 65527 bytes.5, What is the largest possible source port number? Solution: The largest possible source port number is (2°16 ~ 1) = 65535.6, What is the protocol number for UDP? Give your answer in both hexadecimal and decimal notation. (To answer this question, you'll need to look into the IP header.) Solution: ‘The IP protocol number for UDP is 0x11 hex, which is 17 in decimal value. © Internet Protocol Version 4, Srei eacer Length: 28 bytes Differentiated Services Field: 6x Totat Lengtn: 66 Identification: oxa129 (41257) Flags: 0x60 Fragment offset: © 42, 150.236, (282, 150,238.48), dst: 8.8.8.8 (8 (OSCP 6x90: Default: FCM: 0x60: Hot-ECT Mot KOU-Capadte Transport?) P woaaer checksum: @xtcn9 (val1eation a1s201e0) Source; 142. 150.258,48 (142,136.238, 48) Destination: 8.6.8.8 (6.8.8.8) [Source GeotP: Unknow] 000 G0 Te 15 GO BC CO Th ca 39DI be Td OF OTD OT Ee 8826 os Gs 9 a9 60 35 OF TE 19 Se ai 53 01 seese1 eS. Ms7. Examine a pair of UDP packets in which the first packet is sent by your host and the second packet is a reply to the first packet, Describe the relationship between the port numbers in the two packets, Solution: ‘The source port of the UDP packet sent by the host is the same as the destination port of the reply packet, and conversely the destination port of the UDP packet sent by the host is the same as the source port of the reply packet. Frame 67: 74 bytes on wire (592 bits), 7 bytes captured (S82 bits) on interface 6 Ethernet 11, Sec: Apple b?:be:ta (76:ca:39:b2:DCTA), Ost: Cisco s8:Bc!c® (68:16:13 Internet Protocol Version 4. sre: 142,158,236, 49 (142.158.238.48), Dst: 8.8.8.8 (8.8.8.8) User oatagram Protocol, src Fort: 63808 (63808), Dst Fort: $3 (53), Source Port’ 63688 (63865) Destination Fort: $3 (53) Length: a3 D checksum: 6x195e [validation dtsabted] [stream index: 12] D Domain Name System (query) 3) > > > Frame 68: 154 bytes on wire (4232 bits), 154 bytes captured (4232 bits) on interface 6 Ethernet 11, Sre: Cisco 88:be:cB (88: 1e!13:80:bc:cB), Dst: Apple _b2:bc: fd (78:ca:39:b2:be: fd) Internet Protocol Version 4, Src: 8.8.8.8 (8.8.8.8), Dst: 142. 150.238.48 (142. 158.238. 40) User Datagram Frotocol, Src Port: 3 (53), Ost Port: 63868 (63868) Source Port: $3 (53) Destination Fort: 63808 (63888) Tengtn; 128 > checksum: x3498 [validation disabled) (Stream index: 12) > Domain Name System (response) aver