Midterm, CIS 656, Nov 05, 2005. 9:15 - 10:30. Dr Ott. Use the paper provided. Leave a margin. Name on every sheet. 1. Draw, in detail, the header of a TCP packet without options. Explain all fields. Give the sizes of all fields. Where relevant, give the units the field is expressed in. 2. As part of a tcpdump output we obtained the following: 11:46:36.901599 0:2:b3:d3:d4:86 0:2:b3:cd:cd:c9 0800 74: 10.14.0.1.38463 > 63.111.66.12.80: S [tcp sum ok] 2363626268:2363626268(0) win 5840 (DF) (ttl 64, id 17277, len 60) 2A. Explain the meaning of every field in this output. 2B. Is the header above a TCP ``original SYN''? or is it a ``SYN-ACK''? or is it neither? Briefly explain. 3. As part of a tcpdump output we obtained the following: 11:46:36.901599 0:2:b3:d3:d4:86 0:2:b3:cd:cd:c9 0800 74: 10.14.0.1.38463 > 63.111.66.12.80: S [tcp sum ok] 2363626268:2363626268(0) win 5840 (DF) (ttl 64, id 17277, len 60) 4500 003c 437d 4000 4006 6bb5 0a0e 0001 3f6f 420c 963f 0050 8ce2 131c 0000 0000 a002 16d0 1731 0000 0204 05b4 0402 080a 078d 5061 0000 0000 0103 0300 11:46:36.905182 0:2:b3:cd:cd:c9 0:2:b3:d3:d4:86 0800 62: 63.111.66.12.80 > 10.14.0.1.38463: S [tcp sum ok] 498819721:498819721(0) ack 2363626269 win 1380 (ttl 58, id 61490, len 48) 4500 0030 f032 0000 3a06 050c 3f6f 420c 0a0e 0001 0050 963f 1dbb 6289 8ce2 131d 7012 0564 3b9e 0000 0204 0564 0101 0402 3A. Which of the two senders ``understands'' windowscaling? neither? both? the ``initiator'' only? the ``responder'' only? (any other possibility?) Explain your answer. 3B. Explain how you derive from this output the Kind (or Type) and Length of the TCP MSS option. Explain in detail how you derive it from this output, even if you have memorized kind and length. Which of course you should not have done. Feel free to mark up the exam sheet, in that case you must hand in the exam sheet. What are the kind and length? 4. A large file of weather data will be ftp-ed from the supercomputer center in San Diego to the supercomputer center in Pittsburgh. The file size is 640 GBytes. The RTT is 100 msec. Internet II has promised that 600 Mbit/sec will be available for the transfer. For some reason the system administration people want to send this data in 1 FTP (sequentially, i.e, not in parallel in several ftp flows). In your computations you can disregard overhead in header bytes etc. 4A. What window scaling factor is needed? Explain. 4B. What send_buffer size is needed in San Diego? Explain. 4C. What rcve_buffer size is needed in Pittsburgh? 4D. How long will the transfer take (if there are no problems)? 4E. If the system administrators had used the default window scale facter, how long would the transfer have taken? 5. The list of allocated IPv4 multicast addresses in the IANA database contains the line 224.0.1.75 SIP [Schulzrinne] (That is Henning Schulzrinne at Columbia Univ. SIP stands for Session Initiation Protocol.) If a SIP multicast packet is forwarded over an ethernet, what is the ethernet destination address? Give your response in ``standard hexadecimal notation'' and give enough explanation to convince me you understand how this works. 6. A network has address 128.235.64.0/20 . For each of the following addreses. tell whether it can be: Address of interface on the network / source address of packet in the network / destination address of packet in ther network. With a BRIEF but convincing explanation. a. 128.235.64.0 b. 128.235.64.1 c. 128.135.63.255 d. 10.0.1.2 e. 128.235.79.254 f. 0.0.0.0 g. 128.235.79.255 h. 224.0.0.1 i. 127.234.63.1 j. 255.255.255.255