PACKET ANALYSISWITH WIRESHARK

DHCP, DNS, HTTP

Chanhyun park

DHCP

• Dynamic Host Configuration Protocol

• Standardized network protocol for dynamically distributing network configuration parameters such as IP address

• Computers get IP address and networking pa-rameters from a DHCP server• Subnet mask , router, domain name server

• Packet format is well described in WIKI• http://

en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol

DHCP – sequence

DHCP Discover

DHCP Offer

DHCP Request

DHCP Ack

Search DHCP server

DHCP server replies withavailable IP address

Server allocate IP address for client

with options andupdate IP address database

Client select one DHCP server,

request IP address and networking parameters

Client start with DHCP Re-quest

when there is already DHCP IP

DHCP – sequence

DHCP Discover

DHCP Offer

DHCP Request

DHCP Ack

Client start with DHCP Re-quest

when there is already DHCP IP

DNS

• Domain Name System

DNS

• Domain Name System Google.com -> 173.194.127.100

DNS

Ethernet IPUDP

DNS message format

1 byte 2 byte 3 byte 4 byte

Identifier Flag

Num of Questions Num of Answers

Num of Authorities Num of Additional Records

Questions

Answers

Authorities

Additional Records

DNS message format

1 byte 2 byte 3 byte 4 byte

Identifier: 0x804b Flag: 0x0100

Num of Questions: 1 Num of Answers: 0

Num of Authorities: 0 Num of Additional Records: 0

Questions: www.facebook.com, type A, class IN

Answers

Authorities

Additional Records

HTTP

• HyperText Transfer Proto-col• Application protocol for dis-

tributed, collaborative, hy-permedia information sys-tems.

• 1996 – version 1.0

• 1999 – version 1.1 http://www.tcpipguide.com/free/t_HTTPRequestMessageFormat.htm

HTTP

• Request Line – method, URI• HEAD, GET, POST, PUT, DELETE,

TRACE, OPTIONS, CONNECT

• Header Fields• General, Request / Response, Entity• Name, :, values

• Message Bodyhttp://www.tcpipguide.com/free/t_HTTPRequestMessageFormat.htm

HTTP – Wireshark resultsdaum.net

daum.net

Question?