INFA 620 Laboratory 3 Identifying TCP Conversations

INFA 620

Laboratory 3: Identifying TCP Conversations



Find the first TCP handshake. What are the packet numbers in the handshake? The three packet numbers __5__, __6___, and __7__ (20 Points).

What is the IP address of the host that started the handshake? __130.57.20.1__ (15 Points)

What is the TCP port connection pair for this handshake_1026__, _524___ (15 Points)

In the first packet of the handshake, the source port is the ephemeral port this host wants to use for the connection, and the destination port indicates the application the host wants to use on the serving host. What application does the host want to use on the serving host?__TAP-Win32_____ (15 Points)

Look at packet number 14. Is this part of the conversation initiated by the first handshake? __Yes___ (15 Points)


Explain why packet number 7 says “ACK =344.” (20 Points)

It says “ACK=344” because the ACK informs the source on the sequence of the packets expected. Implicit ACK robustness leads to the loss of some ACK’s since when packet 6 is lost, it awaits packet 7 and the source knows the designation has received packet 5 thus information sent by the lost ACKs is successfully deduced from the next ACK thus showing 344