Wireshark Lab 10: UDP
Submitted in Partial Fulfillment of the Requirements for
CIS240
Networking Concepts Spring 2013

1. Select one UDP packet from your trace. From this packet, determine how many fields there are in the UDP header. (You shouldn’t look in the textbook! Answer these questions directly from what you observe in the packet trace.) Name these fields.

There are 4 fields in the UDP datagram
1) Source Port
2) Destination Port
3) UDP Datagram length
4) Checksum field

2. By consulting the displayed information in Wireshark’s packet content field for this packet, determine the length (in bytes) of each of the UDP header fields.

UDP Header Length = Source Port (2 bytes) + Destination Port (2 bytes) + Length Field (2 bytes) + Checksum field (2 bytes) = 8 bytes

3. The value in the Length field is the length of what? (You can consult the text for this answer). Verify your claim with your captured UDP packet.

The length field = 59 bytes – this is the sum of the UDP header (8 bytes) + UDP payload (in this case SMNP data 51 bytes)

4. What is the maximum number of bytes that can be included in a UDP payload? (Hint: the answer to this question can be determined by your answer to 2. above)

The length of the length field is 2 bytes or 216 – 1 less the header bytes = 65535 – 8 = 65527 bytes. This is in theory. In practice, due to avoiding fragmentation in Network layer, this is restricted to the MTU defined in data link layer.

5. What is the largest possible source port number? (Hint: see the hint in 4.)

The length of the port field is 2 bytes or 216 – 1 = 65535 bytes.
6. What is the protocol number for UDP? Give your answer in both hexadecimal and decimal notation. To answer this question, you’ll need to look into the Protocol field of the IP datagram containing this UDP segment (see Figure 4.13 in the text and the discussion of IP header fields).

Protocol: UDP (17) Hex 0x11 7. Examine a pair of UDP packets in which your host sends the first UDP packet and the second UDP packet is a reply to this first UDP packet. (Hint: for a second packet to be sent in response to a first packet, the sender of the first packet should be the destination of the second packet). Describe the relationship between the port numbers in the two packets.

In multiplexing for UDP datagrams for the transport layer, it uses the source and destination ports as the socket #. In the above example, the socket # would be 4344:161 for the sending client and 161:4344 for the receiving node. The source port for the sending node (4334) is the destination port for the receiving nodes datagram. This is the opposite for the receiving node sending back to the sending n