WIRESHARK LAB UDP

Object: To understand the basic concepts of Wireshark using UDP protocol. Theory: In this lab, well take a quick look at the UDP transport protocol. UDP is a streamlined, non-thrills protocol. Because UDP is simple and sweet, well be able to cover it pretty quickly in this lab. So if youve another appointment to run off to in 30 minutes, no need to worry, as you should be able to finish this lab with ample time to spare. At this stage, you should be a Wireshark expert. Thus, we are not going to spell out the steps as explicitly as in earlier labs. In particular, we are not going to provide example screenshots for all the steps.

2010-EE-121

Q:1. Select one packet. From this packet, determine how many fields there are in the UDP header. (Do not look in the textbook! Answer these questions directly from what you observe in the packet trace.) Name these fields. Answer: There is 4 fields : i) Source port ii) Destination port iii) Length iv) Checksum Q:2. From the packet content field, determine the length (in bytes) of each of the UDP header fields. Answer: i) Source port : 2 bytes ii) Destination port : 2 bytes iii) Length : 2 bytes iv) Checksum : 2 bytes Q:3. The value in the Length field is the length of what? Verify your claim with your captured UDP packet Answer: The value in Length field are the UDP header and the data . The minimum length is 8 bytes since thats the length of the UDP header. i.e 54 Q:4. What is the maximum number of bytes that can be included in a UDP payload? Answer: The length field is 16-bit and since the length of the header is 8 bytes so the rest 65527 bytes will be belong to the UDP payload. Q:5. What is the largest possible source port number? Answer: Since the source port is 16-bit in length so the largest possible port number is equal to 65535.

2010-EE-121

Q:6. What is the protocol number for UDP? Give your answer in both hexadecimal and decimal notation. (To answer this question, youll need to look into the IP head? Answer: Protocol number for UDP is 011 or 17 in decimal notation. Hexadecimal = 0x11 Decimal = 161 + 160 = 16+1 = 17 Q:7. Search UDP in Google and determine the fields over which the UDP checksum is calculated. Answer: To calculate UDP checksum a "pseudo header" is added to the UDP header. This includes: IP Source Address 4 bytes IP Destination Address 4 bytes Protocol 2 bytes UDP Length 2 bytes The checksum is calculated over all the octets of the pseudo header, UDP header and data. If the data contains an odd number of octets a pad, zero octet is added to the end of data. The pseudo header and the pad are not transmitted with the packet. Q:8. Examine a pair of UDP packets in which the first packet is sent by your host and the second packet is a reply to the first packet. Describe the relationship between the port numbers in the two packets. Answer: First packet source port is 1050 and destination port is 53. Second packet source port is 53 and destination port is 1050.

2010-EE-121