The idea
Every topic before this one describes a frame you cannot see. This lab is where you look at real ones.
You capture your own traffic, load a page, and then read what actually crossed the wire — the Ethernet header, the IP datagram inside it, the TCP segment inside that, the HTTP request inside that. The encapsulation from Module 1 stops being a diagram and becomes a set of bytes you can click on.
The second half is about ARP, and it exists to make one specific idea concrete: that the destination MAC address in your frame is not the server you are talking to. Several of the questions are built to make you notice that, and the sheet tells you outright that the obvious answer is wrong.
Where marks get lost
This page does not contain the answers
Lab 1 is assessed. It is worth 8 marks, submitted within two weeks of your lab session.
So what follows is what each question is testing, which topic on this site explains the concept, and how to find the answer in Wireshark. The answers themselves are yours to capture — and they have to be, because most of them are specific to your machine, your network and your capture.
What you need
- Wireshark, from
http://www.wireshark.org/download.html, plus thelibpcaporWinPCapcapture library the installer offers - A browser and a command line
- The textbook reference is Kurose & Ross, 8th edition — HTTP p. 861, Ethernet p. 395, ARP p. 612
- RFC 826 for the ARP packet format
How it works
How a sniffer works
Two parts, and the lab sheet separates them deliberately.
The packet capture library receives a copy of every link-layer frame sent or received on an interface. The packet analyser understands the structure of Ethernet frames, IP datagrams, TCP segments and HTTP messages, and displays the fields.
Wireshark is a passive observer. It captures and displays; it never sends. That is why watching a conversation does not change it.
The Wireshark window
Five components, and knowing which is which saves you time in the lab.
| Component | What it gives you |
|---|---|
| Command menus | File to save and open traces, Capture to start, Analyze to enable or disable protocol decoding |
| Packet-listing window | One line per packet — number, time, source, destination, protocol. Sortable by any column |
| Packet-header details | The selected packet expanded layer by layer: Ethernet, then IP, then TCP, then HTTP |
| Packet-contents | The complete frame in hex and ASCII |
| Display filter field | Type http to show only HTTP messages |
The details window is the one that matters most. Expanding it layer by layer is encapsulation read backwards — you are unwrapping exactly what the sending host wrapped.
Phase 1 — getting a capture
Load http://gaia.cs.umass.edu/wireshark-labs/INTRO-wireshark-file1.html with
the capture running, then stop it and filter on http.
| Q | What it tests | Where to look |
|---|---|---|
| 1 | That you can read the protocol column on an unfiltered trace | The protocol column before you apply any filter — you will see more than just HTTP |
| 2 | Round-trip timing | The Time column on the GET and the OK. View → Time Display Format changes the units if you want time-of-day |
| 3 | Telling the two endpoints apart | The source and destination IP fields of the GET. One is you, one is the server |
| 4 | Producing evidence | File → Print, "Selected Packet Only", "Print as displayed" |
Phase 2 — Ethernet and ARP
Clear the browser cache, capture
http://gaia.cs.umass.edu/wireshark-labs/HTTP-ethereal-lab-file3.html, then
Analyze → Enabled Protocols → uncheck IP. That stops Wireshark decoding
above the link layer, so you see the Ethernet and ARP view this phase is about.
The Ethernet questions
| Q | What it tests | The topic that explains it |
|---|---|---|
| 5 | Reading your own 48-bit MAC from the frame | Encapsulation and the four addresses |
| 6 | The key question of the lab. The destination MAC is not the server's — the sheet says so outright. Whose is it? | Physical addresses change every hop |
| 7 | The two-byte Frame type field, in hex, and what protocol it names | The Ethernet frame |
| 8 | Byte offset of the "G" in GET from the frame start | Add up the header lengths — Ethernet, then IP, then TCP |
| 9, 10 | Same pair of questions on the response frame, in the reverse direction | As above |
| 11, 12 | Frame type and byte offset again, on the response | As above |
Aside
Question 6 is the one worth thinking hardest about, and the sheet nudges you twice — it tells you the answer is no, and it sends you back to the textbook.
If you have read Encapsulation and the four addresses, you already know the shape of the answer: a MAC address only means anything on one link. Ask yourself which device is at the other end of your link.
The ARP questions
Task 8 is arp -a — read your cache and explain what each column means.
Then Task 9 clears it with arp -d * (root needed on Linux, Unix and macOS),
clears the browser cache, and captures
http://gaia.cs.umass.edu/wireshark-labs/HTTP-wireshark-lab-file3.html. With
the cache empty, your machine has to ask before it can send — so the first
frames in the trace are the ARP exchange.
| Q | What it tests |
|---|---|
| 13 | Reading the cache and explaining every column |
| 14 | Source and destination MAC on the ARP request frame — look closely at the destination |
| 15 | Frame type field for ARP, and how it differs from the value you found in Q7 |
| 16 | Four parts on the request: where the opcode starts in bytes, its value, whether the sender's IP is present, and where the "question" sits |
| 17 | The same structural reading on the reply, including how its opcode differs |
| 18 | Source and destination MAC on the reply frame |
Question 16 sends you to RFC 826 for the packet format. The ARP topic has the field layout, but the RFC is the authority the sheet points at, and quoting it is worth a mark.
Where marks get lost
Question 19 is the one people get wrong
You download ethernet-ethereal-trace-1 from the supplied
wireshark-traces.zip and look at packets 1, 2 and 6. Packets 1 and 2 are a
request and its reply. Packet 6 is another request, from a different machine —
and there is no reply to it anywhere in the trace.
The question asks why. Resist answering “the reply was lost”. Think about where the capture was taken and which frames a network interface actually receives. An ARP request and an ARP reply are not addressed the same way, and that difference is the whole answer.
Extra credit
Two questions beyond the nineteen:
EX-1 — arp -s InetAddr EtherAddr adds a manual entry. What happens if you
enter the right IP with the wrong Ethernet address?
EX-2 — how long does an entry stay in your ARP cache before it is removed? Find it empirically by watching the cache, or from your OS documentation, and say which method you used.
What the marker wants
| Criterion | Marks | What it covers |
|---|---|---|
| Presentation and format | 1 | Writing clarity, grammar, report structure, template adherence, page limit |
| Experiments (Phase 1 and 2) | 7 | Answer quality, understanding of concepts, completeness of evidence |
Report requirements, from the sheet:
- Maximum 7 pages, title page included
- Due within two weeks of your lab session
- Follow the Canvas template: introduction (two sentences), Phase 1 answers with evidence, Phase 2 answers with evidence, appendix for figures
- Every answer needs evidence — captures and screenshots, annotated to explain what they show
- Print only the minimum packet detail needed for each question
In the exam
The rubric rewards one thing above raw correctness: connecting what you captured to what the lectures taught. The distinction band is described as analysing the questions and linking them to lecture material; high distinction adds detailed analysis connecting experimental findings to lecture concepts.
So when you answer Question 6, do not only name the device. Say why the frame carries that address instead of the server’s, in terms of hop-to-hop delivery. That sentence is the difference between a credit and a distinction.
The same applies to Question 19. The mechanical answer earns the mark; the answer that explains what a NIC does and does not receive earns the band above.