You are on page 1of 1

Analyzing a Home Page Request for www.wikipedia.

org
In order to capture and analyze a home page request, I have taken the wikipedia.org website as a test site. I initiated a new live capture and logged into the wikipedia.org. So as discussed in the class, first the browser would have to know the IP address of the Wikipedia website in order to send the request. So it would have to contact the DNS to know the IP address of website as DNS would have the complete list of IP addresses for all the domain names. Now if the browser wants to contact the DNS, it should have the IP address of the DNS. That and the IP address of my computer would be provided by the ISP (Internet Service provider). To get my IP address and the DNS IP address, I took the help of command prompt. In the command prompt I found my IP address as 192.168.1.16 and my DNS IP address as 192.168.1.1 which is also my default gateway address. In the Wireshark I went on looking at all the packets which were sent and received by my IP address. So there I was able to see that a Standard query was sent to the DNS IP address from my IP address regarding the www.wikipedia.org. The next packets following that were PNRP LOOKUP Message and Authority Message which had IPv6 addresses in the source and destination columns, in which one of the IPv6 address was of my computer. Next a packet was sent from the DNS to my browser as a Standard query response, which I think may contain the IP address of the Wikipedia home page. The next packet sent from my browser was to the IP address 208.80.154.224. Here I used the help of Google to know that the domain name of that IP address was the Wikipedia. So then I knew the IP addresses of my computer, the DNS and the Wikipedia home page. After a couple of packets, a packet having my IP address as source and the Wikipedia IP address as destination was sent using the HTTP protocol with the info as GET / HTTP/1.1. Many packets were exchanged between my IP address and the Wikipedia IP address. For each packet sent by Wikipedia, an acknowledgement packet was sent by my IP address. Here I can expect that the home page information of Wikipedia must be sent to the browser in the form of packets. So to sum up, as far as I know, I can say that first the browser gets the IP addresses of itself and the DNS from the Internet Service Provider (ISP). Then it sends a request query to the DNS regarding the home page request. The DNS (Domain Name System) sends back the response to the browser and a packet having the home page request is sent to the IP address of Wikipedia with the source and the destination address in it. From then onwards the whole information from the Wikipedia is sent to the browser in a sequence of packets till the browser receives the complete requested page. Questions: 1) I tried getting my IP address from the captured packets source and destination addresses, but a lot of IP addresses were present and I could not figure out which IP address was mine. Is it possible to find my IP address from the captured packets?

You might also like