This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Some questions @ Wireshark Capture

-2

Hi Pls kindly help to see,

  1. Is the frame an outgoing or an incoming frame?
  2. Identify the source IP address of the network-layer header in the frame?
  3. Identify the destination IP address of the network-layer header in the frame?
  4. Calculate the total number of bytes in the whole frame?
  5. Estimate the number of bytes in the Ethernet (data-link layer) header?
  6. Estimate the number of bytes in the IP header?
  7. Estimate the number of bytes in the TCP header?
  8. What is the total bytes in the message (at the application layer)?

asked 20 Sep '13, 04:42

Johnson's gravatar image

Johnson
9●1●1●3
accept rate: 0%

edited 20 Sep '13, 08:16

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237

2

Mr. Johnson, aren't you supposed to do your homework by yourself?

BTW: It's well known that teachers monitor this site to trap those who try to cheat. So, be warned ;-)

Regards
Kurt

(20 Sep '13, 04:49) Kurt Knochner ♦
1

Hint: even if you remove the link to the screenshot, it's still there in the history.

http://ask.wireshark.org/revisions/25009/

(20 Sep '13, 05:20) Kurt Knochner ♦

oh, that's mean, spreading panic... :-)

(20 Sep '13, 06:48) Jasper ♦♦
From: :-)   -->>   To: =8-O
(20 Sep '13, 06:50) Kurt Knochner ♦
3

In the future, please direct all homework questions to the Wireshark! Live! Helpdesk.

(20 Sep '13, 07:25) cmaynard ♦♦

cool feature!!

Finally all those newbys get direct access to the most talented Wireshark experts. Maybe I'm going to ask one or two questions myself ;-))

(20 Sep '13, 07:35) Kurt Knochner ♦

Wow, nice, finally, an expert I can ask! :-D

(20 Sep '13, 09:07) Jasper ♦♦
showing 5 of 7 show 2 more comments

One Answer:

1

Yay, homework.

  1. can't tell - where was it captured, and what do you consider incoming or outgoing? It's a question of perspective. A switch considers a frame incoming while the server sending it considers it to be outgoing. So what is your point of origin?
  2. seriously? You can read that easily. It's on the screen.
  3. same
  4. why calculate? it's in the length column
  5. estimate? Its Ethernet II, so 14 bytes. Give or take. Well, not really. It's 14.
  6. at least 20
  7. same
  8. look at the length given in the TCP protocol header summary line in the decode

Sorry for making some fun of this, but you should find these things out yourself, or you'll be in trouble if someone (your teacher/professor) starts asking simple questions...

answered 20 Sep '13, 04:49

Jasper's gravatar image

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%