\documentclass[a4paper,french,12pt]{article}

\title{Networks and Protocols --- Wireshark Lab}
\author{Shanny Guerriau --- Nelson Alikou Dongmo --- Tunui Franken}

\usepackage{styles}

\begin{document}

\maketitle
\clearpage

\section{HTTP}

    \subsection{Basic HTTP GET/response interaction}

        \begin{enumerate}

            \item Is your browser running HTTP version 1.0 or 1.1?
                What version of HTTP is the server running?

                The client and the server are both running HTTP version 1.1.
                (client: trace n°10, server: trace n°12)

            \item What languages (if any) does your browser indicate that it cas accept to the server?

                The \texttt{Accept-Language} header indicates that the browser accepts \texttt{en-us}.

            \item What is the IP address of your computer?
                Of the gaia.cs.umass.edu server?

                The client computer has private address 192.168.1.102.
                The server has address 128.119.245.12.

            \item What is the status code returned from the server to your browser?

                The GET ``OK'' response indicates a 200 status code.

            \item When was the HTML file that you are retrieving last modified at the server?

                The \texttt{Last-Modified} header indicates \texttt{Tue, 23 Sep 2003 05:29:00 GMT}.

            \item How many bytes of content are being returned to your browser?

                The server has returned 73 bytes.

        \end{enumerate}

    \subsection{HTTP conditional GET/response interaction}

        \begin{enumerate}\setcounter{enumi}{6}

            \item Inspect the contents of the first HTTP GET request from your browser to the server.
                Do you see an ``IF-MODIFIED-SINCE'' line in the HTTP GET\@?

                The line is not present.

            \item Inspect the contents of the server response.
                Did the server explicitly return the contents of the file?
                How can you tell?

                The server returned a 200 return status code.
                If it hadn't explicitly returned the contents of the file, it would have returned a 304 status code.

            \item Now inspect the contents of the second HTTP GET request from your browser to the server.
                Do you see an ``IF-MODIFIED-SINCE'' line in the HTTP GET\@?
                If so, what information follows the ``IF-MODIFIED-SINCE'' header?

                This time, the header is present in the browser's request.
                The next header is ``IF-NONE-MATCH''.

            \item What is the HTTP status code and phrase returned from the server in response to this second HTTP GET\@?
                Did the server explicitly return the contents of the file?

                This time the response has a 304 return status code, with a ``Not Modified'' message.
                The server does not send the file contents, because the browser has already cached it.

        \end{enumerate}

    \subsection{Retrieving long documents}

        \begin{enumerate}\setcounter{enumi}{10}

            \item How many HTTP GET request messages did your browser send?
                Which packet number in the trace contains the GET message for the Bill of Rights?

                The browser has sent one GET request.
                This request has packet number 8.

            \item Which packet number in the trace contains the status code and phrase associated with the response to the HTTP GET response?

                The packet n°14 contains the status code and phrase.

            \item What is the status code and phrase in the response?

                The status code returned by the server is 200, associated with the ``OK'' phrase.

            \item How many data-containing TCP segments were needed to carry the single HTTP response and the the text of the Bill of Rights?

                The HTTP response was broken down into 3 separate TCP segments containing data.
                Each segment being 1460 bytes long, they add up to 4272.

        \end{enumerate}

    \subsection{HTML Documents with Embedded Objects}

        \begin{enumerate}\setcounter{enumi}{14}

            \item How many HTTP GET request messages did your browser send?
                To which Internet addesses were these GET requests sent?

                The browser has sent 3 GET request messages to 3 different IP addresses~:
                \texttt{128.119.245.12}, \texttt{165.193.123.218} and \texttt{134.241.6.82}.

            \item Can you tell whether your browser downloaded the two images serially, or whether they were downloaded from the two web sites in parallel?
                Explain.

                The \texttt{Time} column indicates that the GET requests were made separately.
                The TCP data indicates the the Acknowledgement numbers are also independant (their relative value is 1).

        \end{enumerate}

    \subsection{HTTP Authentication}

        \begin{enumerate}\setcounter{enumi}{16}

            \item What is the server's response (status code and phrase) in response to the initial HTTP GET message from your browser?

                The response is 401 --- Authorization Required.

            \item When your browser sends the HTTP GET message for the second time, what new field is included in the HTTP GET message?

                There is an \texttt{Authorization: Basic} field in the GET header.

        \end{enumerate}

\section{DNS}

    \subsection{nslookup}

        \begin{enumerate}

            \item Run \texttt{nslookup} to obtain the IP address of a Web server in Asia.
                What is the IP address of that server?

                The IP addesses of the server is \texttt{58.229.6.225}.

                \begin{lstlisting}[gobble=20]
                    $ nslookup www.aiit.or.kr
                    Server:     10.0.1.1
                    Address:    10.0.1.1#53

                    Non-authoritative answer:
                    Name:       www.aiit.or.kr
                    Address:    58.229.6.225
                \end{lstlisting}

            \item Run \texttt{nslookup} to determine the authoritative DNS servers for a university in Europe.

                \begin{lstlisting}[gobble=20]
                    $ nslookup -type=SOA efrei.net
                    Server:     10.0.1.1
                    Address:    10.0.1.1#53

                    Non-authoritative answer:
                    efrei.net
                            origin = a.dns.gandi.net
                            mail addr = hostmaster.gandi.net
                            serial = 1585830728
                            refresh = 10800
                            retry = 3600
                            expire = 604800
                            minimum = 10800

                    Authoritative answers can be found from:
                    a.dns.gandi.net     internet address = 173.246.98.1
                    a.dns.gandi.net     has AAAA address 2604:3400:abca::1
                \end{lstlisting}

        \end{enumerate}

    \subsection{ipconfig}
    \subsection{Tracing DNS with Wireshark}

        \begin{enumerate}\setcounter{enumi}{2}

            \item Locate the DNS query and response messages.
                Are they sent over UDP or TCP\@?

                The DNS queries are sent over UDP\@.

            \item What is the destination port for the DNS query message?
                What is the source port of the DNS response message?

                The destination port of the query and the source port of the response are the same~: UDP port 53.

            \item To what IP address is the DNS query message sent?
                Use ipconfig to determine the IP addess of your local DNS server.
                Are those two IP addresses the same?

                \begin{lstlisting}[gobble=20]
                    $resolvconf -l
                    # resolv.conf from wlan0.dhcp
                    # Generated by dhcpcd from wlan0.dhcp
                    domain campus.villejuif
                    search campus.villejuif
                    nameserver 10.0.1.1
                    nameserver 192.168.32.5
                    nameserver 192.168.32.6
                \end{lstlisting}

                The IP addresses are not the same because I am using a wireshark trace.

            \item Examine the DNS query message.
                What ``Type'' of DNS query is it?
                Does the query message contain any ``answers''?

                The query type is \texttt{A}, so it is an IPv4 query.
                It does not contain any answer.

            \item Examine the DNS response message.
                How many ``answers'' are provided?
                What do each of these answers contain?

                The response provides 2 answers, each containing an IP address for the query.

            \item Consider the subsequent TCP SYN packet sent by your host.
                Does the destination IP address of the SYN packet correspond to any of the IP addresses provided in the DNS response message?

                The IP is \texttt{132.151.6.75}, which corresponds to the first answer in the DNS response.

            \item This web page contains images.
                Before retrieving each image, does your host issue new DNS queries?

                The images are in the same domain, so the client does not need to issue new DNS queries.

            \item What is the destination port for the DNS query message?
                What is the source port of the DNS response message?

                Again, the destination port for the query and the source port for the response are UDP port 53.

            \item To what IP address is the DNS query message sent?
                Is this the IP address of your default local DNS server?

                The query is sent to \texttt{128.238.29.22}.
                It is an IP address used in the trace, not my local address.

            \item Examine the DNS query message.
                What ``Type'' of DNS query is it?
                Does the query message contain any ``answers''?

                The query is of PTR type.
                It does not contain any answer.

            \item Examine the DNS response message.
                How many ``answers'' are provided?
                What do each of these answers contain?

                The response provides 1 answer containing the domain name corresponding the the requested IP address (reverse DNS).

            \item Provide a screenshot.

            \item To what IP address is the DNS query message sent?
                Is this the IP address of your default DNS server?

                The query is sent to \texttt{128.238.29.22}.
                It is an IP address used in the trace, not my local address.

            \item Examine the DNS query message.
                What ``Type'' of DNS query is it?
                Does the query message contain any ``answers''?

                It is again a PTR type, and does not contain any answer.

            \item Examine the DNS response message.
                What MIT nameservers does the response message provide?
                Does this response message also provide the IP addresses of the MIT nameservers?

                It provides \texttt{dns-prime.poly.edu}.
                The IP address if present, backwards, in the \texttt{in-addr.arpa} field.

            \item Provide a screenshot.

            \item To what IP address is the DNS query message sent?
                Is this the IP address of your default DNS server?
                If not, what does the IP address correspond to?

                The IP is \texttt{18.72.0.3} and corresponds to the IP address in the \texttt{in-addr.arpa} field for the PTR query.

            \item Examine the DNS query message.
                What ``Type'' of DNS query is it?
                Does the query message contain any ``answers''?

                It is again a PTR type, and does not contain any answer.

            \item Examine the DNS response message.
                How many ``answers'' are provided?
                What do each of these answers contain?

                The response contains the \texttt{bitsy.mit.edu}.

        \end{enumerate}

\end{document}
