【Wireshark Lab v8.0】Lab5：UDP

以下实验步骤均来自实验指导手册。

实验指导手册下载地址：Jim Kurose Homepage (umass.edu)

先使用wireshark抓取UDP数据包进行分析

1. Select one UDP packet from your trace. From this packet, determine how many fields there are in the UDP header. (You shouldn’t look in the textbook! Answer these questions directly from what you observe in the packet trace.) Name these fields.

   UDP报文首部共有4个字段，分别为source port字段 destination port字段 length字段 checksum字段

   

2. By consulting the displayed information in Wireshark’s packet content field for this packet, determine the length (in bytes) of each of the UDP header fields.

   首部共有8bytes，每个字段占2个字节

   

3. The value in the Length field is the length of what? (You can consult the text for this answer). Verify your claim with your captured UDP packet.

   length字段是UDP报文的大小，首部字段大小为8个字节，payload是43个字节

4. What is the maximum number of bytes that can be included in a UDP payload? (Hint: the answer to this question can be determined by your answer to 2. above)

   length字段共有16 bit，所以UDP最大长度2^16 = 65536字节，去掉首部所占用的8字节，有效载荷为65528 bytes。

5. What is the largest possible source port number? (Hint: see the hint in 4.)

   src port字段共有16 bit，所以端口范围为[0，2^16 -1],最大为65535

6. What is the protocol number for UDP? Give your answer in both hexadecimal and decimal notation. To answer this question, you’ll need to look into the Protocol field of the IP datagram containing this UDP segment (see Figure 4.13 in the text, and the discussion of IP header fields).

   在ip协议中可以看到显示的为udp(17)，16进制为0x0011

   

7. Examine a pair of UDP packets in which your host sends the first UDP packet and the second UDP packet is a reply to this first UDP packet. (Hint: for a second packet to be sent in response to a first packet, the sender of the first packet should be the destination of the second packet). Describe the relationship between the port numbers in the two packets.

   正好颠倒过来