Chapter 10

TCP/IP Utilities Lab

1.      Issue a Ipconfig command at the command prompt.  Try some of the popular switches such as /all and /?.  Capture a screen shot and write a paragraph about how you would use the command to troubleshoot a problem. 

IPCONFIG is extremely useful for trouble shooting as well as just getting basic info about your IP configuration.  You can use these commands to see not only what your IP address is, but what your default gateway (router, modem, another computer) IP address is.  This will allow you to see if you actually have a connection that will allow you to have internet access and if not you can release and renew your IP address to see if that fixes your problem or if you have to search further.

2.      Issue a Netstat command at the command prompt.  Try some of the popular switches such as - p and -a.  Capture a screen shot and write a paragraph about how you would use the command to troubleshoot a problem. 

NETSTAT allows you to check on services that are running and what ports they are running on, even if the services host is not currently on.  This will allow you to check and see not only if you have a service running, but what port it is running on and this give you the ability to make sure that only services and ports that you want running and open are all that are being used.  This information can allow you to make sure your network is running the way you want it to and allow you to keep hackers and port intrusions from happening.

3.      Issue a Nbtstat command at the command prompt. Try some of the popular switches such as - r and -a.  Capture a screen shot and write a paragraph about how you would use the command to troubleshoot a problem. 

Nbtstat can provide you with NetBios information, statistics and resolve NetBios names to the IP address that they belong to.  While this is a pretty useful tool, it is pointless if your machine is not running NetBios.  So this pretty much rules out any machine that is not a Windows machine.  While this can allow you to see where IP address conflicts are happening and fix them, it won’t allow you to do much of anything if you are running Linux and Unix machines on your network along with your Windows machines.

4.      Issue a Hostname command.

This will allow you to see the name of the host computer that you’re on without having to open up all of the folders to get to the hostname file and see it there.

5.      Use the Nslookup command to view the IP address of at least three domain names. Capture a screen shot and list the class of IP address for each domain.  Put this information in your blog.

Yahoo.com:  69.147.125.65 Class A IP Address

Google.com:  74.125.113.104 Class A IP Address

Facebook.com:  69.63.189.11 Class A IP Address

6.      Issue a Tracert command at home. Capture a screen shot and write a paragraph about how you would use the command to troubleshoot a problem.  Put this information in your blog.

Tracert basically traces the route your connection takes to get to the other device or site that you are attempting to connect to.  It even tells you over how many hops it is going to try so you’ll know the time to live for the packet it sends to check the route.  I would use this for if I’m not able to connect to either a device, like a network printer, or a website that I normally use.  I could follow the path to see if the packet is exceeding the TTL set for it or to see if the packet is getting hung up at one of the “hops” it takes along its route to the destination point.  This would allow me to see if the problem was because of the TTL being too short or because of a routing problem.

Chapter 4

Wireshark Lab

1. Start wireshark and view the packets that are being picked up by your computer.
2. Look at several packets and then complete the following :
1. Look at a packet that is using TCP and then answer the following:

                                                               i.      What is the source port? Why is this source port used?

Source port is 80, it is the standard port used for TCP/IP.

                                                             ii.      What is the destination port?  Why is this destination port used?

Destination port 50342, a random port available to allow incoming traffic.

                                                            iii.      What is the flag? Why is this flag used?

The flag used is 0x12 (Syn, Ack), it’s used for acknowledgment.

                                                           iv.      What is the source and destination IP address? Is this packet coming or going from your computer? (Use IP config  command from the command prompt to view the IP address of your computer).

Source IP:  98.137.80.31 Destination:  192.168.2.5, this packet was coming into my computer.

                                                             v.      What is the Time To Live for this packet? What does TTL mean?

The TTL for this packet is:  55.  TTL is the time in seconds or number of hops set for the packet on how long or how many times it can hop before it is discarded.

                                                           vi.      What is the Differentiated Services field?  List the current value. What does this mean?  List 4 other possible values.

The Differentiated Service Field is a mechanism for traffic management.  The current value is 0x00.

                                                          vii.      What is the protocol field set to? What does this mean?

The protocol field is set to TCP and this means Transmission Control Protocol.

                                                        viii.      What else did you see that was interesting about the IP packet?

I noticed that the packet was not only broken down with source and destination from my computer to the router, but also from the router to the internet.

                                                           ix.      What is the framing type used?

The framing type used is Ethernet II

                                                             x.      What is the source and destination MAC addresses?  Is this frame coming or going from your computer? (Use IP config /all command from the command prompt to view the MAC address of your computer).

Source MAC:  00:22:75:bf:07:43  Destination MAC:  00:26:18:0d:44:41 and this packet is coming to my computer.

                                                           xi.      What else did you see that was interesting about the Frame?

I could see the MAC addresses for my router and my computer but I could not see the MAC address for the server that was sending the frames and packets to my modem and then my router then to my computer.

2. Look at a packet that is using UDP and then answer the following:

                                                               i.      What is the source port? Why is this source port used?

Source Port:  3540 and it is used by tcp/udp for a PNRP (Peer Network Resolution Protocol) user port.

                                                             ii.      What is the destination port?  Why is this destination port used?

Destination Port: 3540 and just like the source port it is used by tcp/udp for a PNRP user port.

                                                            iii.      What is the flag? Why is this flag used?

Flag:  0

                                                           iv.      What is the source and destination IP address? Is this packet coming or going from your computer?

Source:  fe80::2461:f7e4:a714:e67d  Destination:  fe80::2d9a:74c4:fdb7:86bd  IPv6 was used and this packet is coming to my computer.

                                                             v.      What is the Time To Live for this packet? What does TTL mean?

The TTL is 128.  TTL is the time in seconds or number of hops set for the packet on how long or how many times it can hop before it is discarded.

                                                           vi.      What else did you see that was interesting about the IP packet?

I thought that it was very interesting that the packet used IPv6 instead of the normal IPv4.

                                                          vii.      What is the framing type used?

The framing type used is Ethernet II.

                                                        viii.      What is the source and destination MAC addresses?  Is this frame coming or going from your computer?

Source MAC:  e0:cb:4e:40:23:24 Destination MAC:  00:26:18:0d:44:41 and it is coming to my computer.

                                                           ix.      What else did you see that was interesting about the Frame?

Again, the fact that IPv6 was used instead of IPv4.  This is a really odd thing to see as I’m use to nothing but IPv4, however it is the new thing is IPv6 so I should expect to see more of it in the future.

3. Intercept several TCP packets until you can view the three way handshake (read about this on pg 118 and 119). What are the sequence and acknowledgement numbers on all 3 segments?

4. Intercept an ARP frame.  List the following:

                                                               i.      What is the destination MAC address? Why is this address used?

Destination MAC: e0:cb:4e:40:23:24 It is used because ARP knows the MAC address of the computer it want to speak but not the IP address.

                                                             ii.      What is the source MAC address? Why is this address used?

Source MAC:  00:26:18:0d:44:41  It is used for the same reason as above.

                                                            iii.      What is the destination IP address? Why is this address used?

Destination IP:  192.168.2.5  It is used because ARP was used before to discover it so the computers can talk via IP instead of MAC.

                                                           iv.      What is the source IP address? Why it this address used?

Source IP:  192.168.2.4 It is used for the same reason as above.

5. Write at least a half page about Wireshark.  What did you learn? What was interesting? Do you feel this is a valuable program? Etc;

Using Wireshark was very interesting.  The amount of traffic that is sent and received over a connection in such a short period of time is truly mind boggling.  I never thought that it was as much as what I saw.  The information in the packets are very useful for tracking things as well as trouble shooting.  You can track and trace every packet that leaves or enters your computer.  By doing this you can very easily see where the problem or the security threat in your system is or is coming from.  On the other hand it is also an extremely useful tool for hackers because they can see what you’re sending out and what you’re receiving it.  I definitely think this is a very useful tool, but the real question is:  Who is it more useful for, the trouble shooter or the hacker?

DHCP Lab

In this Lab we setup D-Link routers and set them to have specified DHCP pool of IP addresses for the computers connected to them to choose from.

The first step was to bring up the command prompt and do an ipconfig command so we could see the IP address of the router which would allow us to get to the interface shown below.

Once the interface was up we had to maneuver through the available menus until we got to the DHCP settings area.  While this sounds easy, and the menu surfing is, it does get much harder as you have to know what subnet and subnet mask you want/need to be using .  This information is crucial to the execution of this because without the proper subnets and masks the whole setup will not work.  For instance, you cannot use a standard class C subnet mask of 255.255.255.0 on a class C address that is subnetted down further because technically they are different addresses and it will throw the scheme off.  Once you have all your addresses in place you’ll see this:

Host File Lab

This lab was very useful for the computers in our networking lab because of the way they are setup on the schools network.  The setup that they have will now allow you to go directly to Blackboard by typing in the normal web address of blackboard.carteret.edu so you have to actually type in the IP address of 10.10.1.80.  Now if you didn’t know the IP address for Blackboard then you would be in a pretty sticky situation here because there would be no other way to get there.

To use the host file to solve this problem for other users that may not know the actual IP address you have to locate it first.  The path to it is the same for all computers and it’s really easy to get to.  Open your hard drive, which is normally the drive letter C: on your computer.  From there you will open the Windows folder, then the System32 folder, then the drivers folder and then finally the etc folder.  What you will have will look like this:

Here is where we open the host file and proceed to do our editing.  We will be putting the normal web address of blackboard.carteret.edu along with the IP address of 10.10.1.80 at the end of the file so the computer will recognize the website when we put in the normal blackboard.carteret.edu web address.  The finished product will look like this:

Doing this simple edit will allow the average user to just enter in normal well known web addresses for their sites when things aren’t working like they are accustom too.  Of course you could also play around with this and have some fun with the unsuspecting person and have the address of http://www.yahoo.com/ take them to www.google.com.

Chapter 3



Cable Lab

Here we created a straight through cable from CAT-5 cable and two RJ-45 jacks.  This lab was very straight forward and with the wiring diagram pretty simple. 

The first thing we had to do was to take the CAT-5 cable and use a standard pair of wire strippers to get the UTP’s exposed from inside the outer yellow cover of the cable.  Once they’re exposed we untwisted them and separated them by color. 

Once we had the wires separated we used the 568b Cable Standard:

to organize and setup the way they wires would be for insertion into the RJ-45 connectors.  This was one of the most important steps because the two ends of the cable had to be identical for it to be an actual straight through cable and work properly.  As the diagram above shows, all 8 of the wires are used and they are identical in both ends the way they are setup.  This makes the straight through cable.

Once the wires were trimmed back so they were about a quarter of an inch in length, we slipped them into the RJ-45 connector (ensuring the connectors clip was facing away from us) and watched to make sure the order did not change and that the ends of the wires remained flush and as far to the end of the connector as possible.  We then used a tool called a crimper to close the opening of the connector around the cable so the wires would not come out of the connector.  After the first end was completed it was a rinse and repeat on the other end and then we had a completed cable.

After the cable was completed we hooked it up to a tester to test the connectivity of the cable and make sure that it was done correctly.  We also did a punch down connection that also required the CAT-5 cable to be opened up and the UTP’s to be exposed and separated.  Once they were separated we followed the color code on the punch down connector to place the UTP wires where required, then we used the punch down tool to “punch” the wires down into the slots and trim the ends off in one swift motion.

The following picture shows the tester with my finished straight through cable connected and tested, the crimper tool, wire stripers, punch down tool and the finished punch down.