dreaife的休憩小栈

3.1 DNS UDP Data Analysis#

Use tcpdump to capture DNS query network packets, and analyze UDP data with Wireshark.

For example:

1
dig www.xju.edu.cn

3.2 QQ UDP Data Analysis#

Use Wireshark to capture QQ network communication packets, and analyze UDP data.

Messages between QQ clients are transmitted using UDP. The domestic network environment is very complex, and many users access the Internet via proxy servers sharing a single line; UDP packets can penetrate most proxy servers, so QQ chose UDP as the communication protocol between clients. Therefore, we open the QQ chat window to start capture, chat with a friend, and stopping the capture yields UDP packets.

4.1 Based on captured packets, analyze the UDP datagram structure and fill in the field names, field values, and field information in the table below:#

• DNS UDP Data Analysis

First, capture with tcpdump -i eth0 -w test.cap and traceroute www.xju.edu.cn -T, then analyze the data in test.cap. The procedure is shown in the figure below:

Then filter DNS and analyze UDP data, as shown in the figure below

Enter the obtained data into the table below

• QQ UDP Data Analysis

Capture local QQ data with Wireshark, process shown below:

1. Select Ethernet

1. Stop capture

1. Filter OICQ and analyze the obtained data

Enter the obtained data into the table below

4.2 From the analysis results, what parts make up the UDP datagram and what are their functions?#

From the data obtained in the experiment, we can see that the UDP datagram consists of two parts: UDP header (8 bytes) + UDP data/payload, where the UDP header is composed of source port, destination port, length, and checksum.

The four fields in the UDP header each occupy two bytes (16 bits), and their functions are:

Source Port
The source port helps the server-side application determine the origin of the datagram.
Destination Port
The destination port allows the destination host to deliver the application data to the process listening on the destination port (i.e., the responding process).
Length
The Length field indicates the number of bytes in the UDP datagram (header plus data). Because the length of the data field in a UDP datagram is not fixed, a length field is needed to facilitate processing by the receiving end.
Checksum
The receiver uses the checksum to verify whether errors occurred in this datagram.

5.1 Issues and Solutions#

When using traceroute, the error -bash: traceroute: command not found occurred. Solution: install traceroute using the command yum install traceroute, which installs traceroute. When connecting to the server with Xftp, connection errors occurred. Solution: after switching to the campus network, the connection returned to normal; investigation showed the issue was caused by the server firewall.

5.2 Reflections#

• This experiment familiarized the operation of code and software in IP protocol analysis, as well as the analysis and extraction of UDP datagrams, validating the knowledge learned in class. Through this experiment, I mastered the concrete workflow of using the traceroute command, understood the basic usage of commonly used IP protocol analysis software, and improved my programming ability.
• Through these common IP protocol analysis commands and the tracing/analysis of IP protocol usage, and UDP datagram structure analysis, I corroborated what was taught in class.