Articles and resources are archived to the public account [AIShareLab] and can be obtained by replying to Communication Systems and Networks.
Article directory
- First, the purpose
- 2. Environment and network topology
- 3. Steps and result analysis
-
- (1) Place and connect the equipment.
- (2) Start the device.
- (3) Configuration implementation.
- (4) Connectivity test.
- (5) Packet capture analysis.
-
- ①Start packet capture.
- ②Run the command.
- ③Analyze the message.
- Ⅰ Analyze ARP packets
- Ⅱ Analyze ICMP packets
1. Purpose
1. Be familiar with the use of the simulated experimental environment eNSP;
2. Master the methods of networking, configuration and testing in eNSP;
3. Master the views, commands and configuration methods of Huawei network equipment;
4. Master how to use Wireshark to capture and analyze data packets;
5. Familiar with common network command protocol mechanisms and usage methods;
2. Environment and network topology
A computer PC1 and a router AR1 are directly connected through a network cable. The network topology is shown in Figure 1. Among them, the IP address of PC1 is 192.168.1.1/24, the default gateway IP address is 192.168.1.254, and the IP address of the AR1 GE0/0/0 interface is 192.168.1.254/24. The topology is shown in Figure 1.
Figure 1 Network topology diagram using eNSP
3. Steps and results analysis
1. Start the eNSP program, click “New Topology”, and a blank workspace will pop up as shown in Figure 2:
Figure 2 eNSP user interface
(1) Place and connect equipment.
①Place the router: Select the device type “Router” in the device type selection box, and then select the device in the device selection box
Model, in this example select AR1220. Move the cursor to the work area, the cursor changes to the selected device model, click the mouse to complete
The placement process of the AR1220 device is shown in Figure 3.
Note: If you need to place multiple devices of this model, you can do it by repeating the same operation multiple times. If you need to place other models of equipment, you can re-select the new device type in the device type selection box and select the new device model in the device selection box. If you no longer have the device, you can click the “Restore Mouse” button in the toolbar.
Figure 3 Place the router in the work area
② Place the computer: Select the device type “Terminal” in the device type selection box, and then select the device model in the device selection box. In this example, select PC. Move the cursor to the work area, the cursor changes to the selected device model, click the mouse to complete the terminal placement process for the PC model, as shown in Figure 4.
Figure 4 Place the computer in the work area
③Device connection: Select “Device connection” in the device type selection box, and select various correct connection line types in the device selection box. In this example, select Copper. Select Copper, click the left mouse button on the devices at both ends that need to be connected, and the interface list of the device will pop up. Select the interface that needs to be connected in the interface list. After selecting the interfaces on the devices at both ends that need to be connected, complete the connection process, as shown in Figure 5.
Figure 5 Device connections in the workspace
(2) Start the device.
Click the “Restore Mouse” button in the toolbar to restore the mouse, drag the mouse in the workspace to select the range of devices that need to be started, and click the “Turn on Device” button in the toolbar to start the startup process of the selected device, as shown in the figure As shown in 6, the status of the ports at both ends of the connection cable turns green, and the startup process is completed. Only after completing the startup process can you start the configuration process of the device.
Figure 6 Network topology after device startup
(3) Configuration implementation.
① Configure the router: After the device in the workspace completes the startup process, double-click router AR1 to enter the CLI interface of the device, as shown in Figure 7.
Figure 7 Router CLI interface
Complete the basic configuration of the router in the command line interface, as follows:
<Huawei> system-view //Enter system view from user view Enter system view, return user view with Ctrl + Z. [Huawei] interface GigabitEthernet 0/0/0 //Enter the interface view of interface GigabitEthernet0/0/0 from the system view [Huawei-GigabitEthernet0/0/0] ip address 192.168.1.254 24 //Configure the IP address 192.168.1.254 and prefix 24 (subnet mask 255.255.255.0) for interface GigabitEthernet0/0/0
② Configure the computer: Double-click the computer PC1 icon to pop up the device configuration management window, which includes five tabs: basic configuration, command line, multicast, UDP packet sending tool and serial port. As shown in Figure 8, statically configure the IP address, subnet mask and gateway address of computer PC1 in the corresponding fields, and then click the “Apply” button.
Figure 8 Configure computer PC1 address information
(4) Connectivity test.
①PC1 ping AR1 GE0/0/0: Double-click the computer PC1 icon to pop up the device configuration management window. Click the “Command Line” tab to open the command prompt interface. At the command prompt, enter ping 192.168.1.254, and you can receive the response information from AR1, as shown in Figure 9, which indicates that computer PC1 is connected to GE0/0/0 of router AR1.
Figure 9 PC1 ping AR1 GE0/0/0
②AR1 ping PC1: Double-click router AR1 to enter the CLI interface of the device. Enter ping 192.168.1.1 in the command line interface. The result is as shown in Figure 10, indicating that router AR1 and PC1 are connected to each other.
Figure 10 AR1 ping PC1
(5) Packet capture analysis.
eNSP combined with Wireshark can capture various types of packets exchanged during the operation of network devices and display the values of each field in the packets.
①Start packet capture.
As shown in Figure 11, right-click the computer PC1 icon, select “Data Capture” from the pop-up options, then select the corresponding interface “Ethernet0/0/1”, start Wireshark and start capturing data passing through the interface Bag.
Figure 11 The PC1 port displays a blue dot indicating that the capture process is in progress
As shown in Figure 12, a blue dot appears on the Ethernet0/0/1 port of PC1, indicating that the capture process is in progress.
Figure 12 The PC1 port displays a blue dot indicating that the capture process is in progress
②Run the command.
Taking the connectivity test as an example, double-click the computer PC1 icon to pop up the device configuration management window. Click the “Command Line” tab to open the command prompt interface. At the command prompt, enter the following commands in sequence: arp -d; arp -a; ping 192.168.1.254 to complete clearing the ARP cache, querying and confirming the ARP cache, and testing the connectivity with 192.168.1.254. , the result is shown in Figure 13, it can be seen that the response information of AR1 can be received.
Figure 13 Clear ARP cache and test connectivity
③Analyze the message.
In the Wireshark interface, click the “Stop Capture Group” button in the toolbar to obtain the captured information, as shown in the figure
As shown in Figure 14, it shows that during the connectivity test between PC1 and AR1, multiple data packet interactions using ARP and ICMP protocols were generated.
Figure 14 Captured packets
Ⅰ Analyze ARP packets
⑴ Filter the data packets and view the protocol stack. Enter “arp” in the display filter to filter and display the ARP packets, as shown in Figure 14. In the packet details panel, you can see that the protocol stack corresponding to the ARP packets mainly contains three layers, among which, Frame 1 represents the relevant information in bits on the physical layer of data packet No. 1 captured by the network card; Ethernet II represents that the captured information is encapsulated in the Ethernet II frame format on the data link layer; Address Resolution Protocol represents all The captured information is encapsulated using the ARP protocol at the network layer.
Answer the following questions:
Combined with the captured information, the bottom-up protocol stack structure of ARP packets is explained.
Looking from bottom to top, the protocol stack structure of the ARP packet is as follows:
Data link layer (Ethernet II): destination address, source address, and type fields. In this example, the destination address is the broadcast address (ff:ff:ff:ff:ff:ff), the source address is 00:0c:29:aa:bb:cc, and the type field is ARP (0x0806).
Network layer (ARP): hardware type, protocol type, hardware address length, protocol address length, opcode, sender MAC address, sender IP address, destination MAC address, and destination IP address.
Therefore, the protocol stack of ARP packets from bottom to top is: data link layer (Ethernet II), network layer (ARP).
Figure 15 Filtering ARP messages
⑵ Combined with the communication process, analyze the protocol mechanism. As shown in Figure 15, the ARP resolution process includes two processes: request and response, and the corresponding ARP packets generated are ARP request and ARP response respectively.
Answer the following questions:
Why are ARP packets present here and what does they do ?
Answer: The purpose of the ARP packet is to help the sending device resolve the MAC address of the target device. When the sending device needs to communicate with the target device, it sends an ARP request packet that contains the IP address of the target device. If the target device is on the same LAN, it will receive the ARP request and reply with an ARP reply packet containing the MAC address of the target device. After the sending device will receive the ARP reply, it can send the packet to the target device. After receiving the message, the IP address and physical address are stored in the local ARP cache and retained. The ARP cache is directly queried on the next request to save resources.
⑶Analyze single data packet format.
① ARP request: Taking No. 1 as an example, click packet No. 1 in the packet list panel and select an ARP request packet. Then expand the packet details panel to display the details of the packet.
Answer the following questions:
a. What are the hexadecimal values of the source and destination addresses in the Ethernet frame that contains the ARP request message?
Figure 16 ARP message related information
Answer: As shown in Figure 16, source address: 54:89:98:25:0a:65 Destination address: ff:ff:ff:ff:ff:ff
b. Give the hexadecimal value of the double-byte Ethernet frame type field. What upper layer protocol does this correspond to?
Answer: 0x0806 ARP protocol
c. Does the Ethernet frame containing the ARP request message contain padding fields?
Answer: As shown in Figure 15, it contains populated fields.
d. Does the ARP message contain the sender’s IP address?
Answer: ARP messages contain the sender’s IP address. In the ARP request message, the sender will put its own IP address into the source IP address field of the ARP request message so that the recipient knows which IP address the request comes from. After the receiver receives the ARP request message, it will use the source IP address in the request to determine the sender of the request. In the ARP reply message, the sender will also put his own IP address into the source IP address field of the ARP reply message so that the recipient knows which IP address the reply comes from. After the receiver receives the ARP reply message, it will use the source IP address in the reply to determine the sender of the reply.
e. Where does the “question” (ie, querying the Ethernet address of the machine using the corresponding IP address) appear in the ARP request?
A: Appears in bytes 32-37.
②ARP reply: Similarly, select packet No. 2, which is the ARP reply packet sent in response to the ARP request, and then expand the details of the packet.
Figure 17 arp packet No. 2
Answer the following questions:
a. Where does the “answer” to the previous ARP request (that is, the Ethernet address of the machine that answered with the corresponding IP address) appear in the ARP message?
A: Appears in bytes 22-27.
b.What are the hexadecimal values of the source and destination addresses in the Ethernet frame containing the ARP reply message?
Answer: Source address: 00:e0:fc:32:80:6d Destination address: 54:89:98:25:0a:65.
Ⅱ Analyze ICMP packets
⑴ Filter the data packets and view the protocol stack. Enter “icmp” in the display filter to filter and display ICMP packets, as shown in Figure 18.
Answer the following questions:
Combined with the captured information, the bottom-up protocol stack and encapsulation structure of ICMP packets are explained.
Viewed from bottom to top, the encapsulation structure of the ICMP packet is as follows:
Data Link Layer (Ethernet II): Destination Address, Source Address, and Type fields.
Network layer (IPv4): version, header length, service type, total length, identifier, flags, slice offset, time to live, protocol, header checksum, source and destination addresses.
Transport layer (ICMP): type, code, checksum, identifier, sequence number and data.
Therefore, the protocol stack of ICMP data packets from bottom to top is: data link layer (Ethernet II), network layer (IPv4), and transport layer (ICMP).
Figure 18 Filtering ICMP messages
⑵ Combined with the communication process, analyze the protocol mechanism. Multiple pairs of ICMP packets are generated during the ping process, each pair containing an ICMP request and an ICMP reply.
Answer the following questions:
How many ICMP request and reply packets are present here? Are the results consistent with the results displayed by the test command?
Answer: According to the experimental results, there are a total of 5 ICMP request packets and 5 ICMP response packets, which are consistent with the results displayed by the test command.
⑶Analyze single grouping format.
Answer the following questions:
a. What is the IP address of the source host? What is the IP address of the target host?
Answer: Source host address: 192.168.1.1 Destination host address: 192.168.1.254
b.Why do ICMP packets have no source and destination port numbers?
Answer: In ICMP messages, the IP addresses of the sender and receiver are used to identify the source and destination of the message. Various types of messages in ICMP messages have different type codes. These type codes are used to identify the specific type and purpose of the message. Therefore, ICMP uses IP addresses and type codes to determine the source and destination of messages, rather than port numbers.
c. View a ping request packet sent by the host. What are the ICMP types and code numbers? What other fields does this ICMP packet have? How many bytes are the checksum, sequence number, and identifier fields?
Figure 19 ICMP message related information
Answer: As shown in Figure 19, the ICMP type is 8 and the code number is 0; the ICMP packet contains the following fields:
Checksum: used to detect whether the ICMP packet is damaged during transmission, accounting for 2 bytes.
Identifier: used to match between ICMP request and response messages, occupies 2 bytes.
Sequence Number: used to match between ICMP request and response messages, occupies 2 bytes.
Other data: ICMP messages also contain protocol fields, source IP address and destination IP address fields, time-to-live field, flag field, header checksum field, offset field, protocol field, checksum field, Identifier field, sequence number field, data fields etc. Therefore, ICMP packets contain fields such as type, code, checksum, identifier, sequence number, and other data. Among them, the checksum, identifier and sequence number fields each occupy 2 bytes, taking up a total of 6 bytes of space.
d. Check the corresponding ping response packet. What are the ICMP types and code numbers? What other fields does this ICMP packet have? How many bytes are the checksum, sequence number, and identifier fields?
Figure 20 ICMP response packet related information
Answer: As shown in Figure 20, the ICMP type is 0 and the code number is 0; the ICMP packet contains the following fields:
Checksum: used to detect whether the ICMP packet is damaged during transmission, accounting for 2 bytes.
Identifier: used to match between ICMP request and response messages, occupies 2 bytes.
Sequence Number: used to match between ICMP request and response messages, occupies 2 bytes.
Other data: ICMP messages also contain protocol fields, source IP address and destination IP address fields, time-to-live field, flag field, header checksum field, offset field, protocol field, checksum field, Identifier field, sequence number field, data fields etc. Therefore, ICMP packets contain fields such as type, code, checksum, identifier, sequence number, and other data. Among them, the checksum, identifier and sequence number fields each occupy 2 bytes, taking up a total of 6 bytes of space.