Wireshark Lab 5: TCP
Raja Rajeswari Paruchuri
#244084
1. What is the IP address and TCP port number used by the client computer (source) that is transferring the file to gaia.cs.umass.edu? To answer this question, it’s probably easiest to select an HTTP message and explore the details of the TCP packet used to carry this HTTP message, using the “details of the selected packet header window” (refer to Figure 2 in the “Getting Started with Wireshark” Lab if you’re uncertain about the Wireshark windows.

Answer: The IP address for the host is 192.168.1.102 and the port number is 1161.

2. What is the IP address of gaia.cs.umass.edu? On what port number is it sending and receiving TCP segments for this connection?
Answer: The IP address of gaia.cs.umass.edu is 128.119.245.12 and the port number used for this connection is 80

3. What is the IP address and TCP port number used by your client computer (source) to transfer the file to gaia.cs.umass.edu?
Answer:

I did this packet capture on my PC.
From the above figure, my client computer’s IP address is 10.0.0.5 and the TCP port is 60834. 4. What is the sequence number of the TCP SYN segment that is used to initiate the TCP connection between the client computer and gaia.cs.umass.edu? What is it in the segment that identifies the segment as a SYN segment?
Answer: The sequence number of the TCP SYN segment is zero and the Syn flag is set to 1 which indicates that this segment is a SYN segment.

5. What is the sequence number of the SYNACK segment sent by gaia.cs.umass.edu to the client computer in reply to the SYN? What is the value of the Acknowledgement field in the SYNACK segment? How did gaia.cs.umass.edu determine that value? What is it in the segment that identifies the segment as a SYNACK segment?
Answer: (Results of packet captured in my PC)

According to the below figure, the sequence number of the SYNACK segment sent by gaia.cs.umass.edu to the client computer in reply to the SYN is 0. The value of the acknowledgement field in the SYNACK segment is 1. The value of the Acknowledgement field in the SYNACK segment is determined by the server gaia.cs.umass.edu. The server adds 1 to the initial sequence number of SYN segment form the client computer. For this case, the initial sequence number of SYN segment from the client computer is 0, thus the value of the Acknowledgement field in the SYNACK segment is 1. A segment will be identified as a SYNACK segment if both SYN flag and Acknowledgement in the segment are set to 1.

6. What is the sequence number of the TCP segment containing the HTTP POST command? Note that in order to find the POST command, you’ll need to dig into the packet content field at the bottom of the Wireshark window, looking for a segment with a “POST” within its DATA field
Answer: (Results of packet captured in my PC) According to below figure, the segment No.94 contains the HTTP POST command, the sequence number of this segment is 1.

7. Consider the TCP segment containing the HTTP POST as the first segment in the TCP connection. What are the sequence numbers of the first six segments in the
TCP connection (including the segment containing the HTTP POST)? At what time was each segment sent? When was the ACK for each segment received? Given the difference between when each TCP segment was sent, and when its acknowledgement was received, what is the RTT value for each of the six segments? What is the EstimatedRTT value (see Section 3.5.3, page 239 in text) after the receipt of each ACK? Assume that the value of the EstimatedRTT is equal to the measured RTT for the first segment, and then is computed using the EstimatedRTT equation on page 239 for all subsequent segments.
Answer:

Segments 1-6

ACK of segments 1‐6 According to above figures, the segments 1‐6 are No. 4, 5, 6, 7, 8 and 12 The ACK of segments 1‐6 are No. 9, 11, 13, 15, 17 and 19. Segment 1 sequence number is 1 Segment 2 sequence number is 566. Segment 3 sequence number is 2026 Segment 4 sequence number is 3486 Segment 5 sequence number is 7866 Segment 6 sequence number is 9013
The estimated RTT of packet 1 is: 0.875 * .028 + 0.125 * .028= .028
The estimated RTT of packet 1 is: 0.875 * .042+ 0.125 * .035 = .035
The estimated RTT of packet 1 is: 0.875 * .054 + 0.125 * .070 = .070
The estimated RTT of packet 1 is: 0.875 * .055+ 0.125 * .114 = .114
The estimated RTT of packet 1 is: 0.875 * .077+ 0.125 * .140 = .140
The estimated RTT of packet 1 is: 0.875 * .078+ 0.125 * .190 = .190

8. What is the length of each of the first six TCP segments?
Answer:

The length of the first TCP segment is 565 bytes, the length of the second TCP segment is 1460 bytes. The length of each of the following five TCP segments is 1460 bytes.

9. What is the minimum amount of available buffer space advertised at the received for the entire trace? Does the lack of receiver buffer space ever throttle the sender?

Answer:

The minimum amount of available buffer space advertised at the received for the entire trace is indicated first ACK from the server, its value is 5840 bytes (shown in above figure). This reviver window grows until it reaches the maximum receiver buffer size of 62780 bytes. According to the trace, the sender is never throttled due to lacking of receiver buffer space.

10. Are there any retransmitted segments in the trace file? What did you check for (in the trace) in order to answer this question?
Answer: There is no retransmitted segments in the trace file since in the time sequence graph (stevens), all sequence numbers are gradually increasing.

11. How much data does the receiver typically acknowledge in an ACK? Can you identify cases where the receiver is ACKing every other received segment (see Table 3.2 on page 247 in the text).

Answer:

The difference between the acknowledged sequence numbers of two consecutive ACKs indicates the data received by the server between these two ACKs. The receiver is ACKing every other segment. For example, segment of No. 10 acknowledged data with 1460 bytes. 12. What is the throughput (bytes transferred per unit time) for the TCP connection? Explain how you calculated this value.
Answer:
The alice.txt on the hard drive is 152,138 bytes, and the download time is 1.378736000 (First TCP segment) ‐ 0.0264770 (last ACK) = 1.120747 second. Therefore, the throughput for the TCP connection is computed as 152,138/1.120747=135746.96162 bytes/second 13. Use the Time-Sequence-Graph(Stevens) plotting tool to view the sequence number versus time plot of segments being sent from the client to the gaia.cs.umass.edu server. Can you identify where TCP’s slowstart phase begins and ends, and where congestion avoidance takes over? Comment on ways in which the measured data differs from the idealized behavior of TCP that we’ve studied in the text.
Answer:

The slow start of the TCP seems to begin at about 0.004 seconds and then ends at about 0.3 seconds. Congestion avoidance takes over at about 0.3 seconds because it cut down the amount being sent. * Answer each of two questions above for the trace that you have gathered when you transferred a file from your computer to gaia.cs.umass.edu
Answer:
Already the above answers are based on the tcp-ethereal zip file .