W1·A3 — Where are the layers

Time: 30 min

Needs: A2's topology

GNS3 project: w01-a2-roles (continue in it)

Predict first

How many different kinds of metadata does a request need to carry to retrieve a web page?

Can you name them?

Do this — capture one ping

1. Start the web server on H1 (see previous activity if you don't remember how)

2. Right-click the H2 link → Start capture. Wireshark opens on that link and starts empty.

3. On H2:

   curl http://192.168.10.11:8080/index.html
   

4. Read Wireshark. Select one packet and look at the details pane. Each row is a layer. How many rows are there?

5. Click each layer (ignoring Frame, which is Wireshark's own metadata, not bytes on the wire) and watch the bottom pane highlight the bytes it owns.
6. Watch carefully the status bar at the bottom of the screen. It shows the number of bytes the selected layer contains.
7. Select one HTTP packet, click each layer in turn and write down the number of bytes in each layer.
8. Expand each row and scan the contents.

What just happened?

• By capturing on H2 cable, you were able to see the entire conversation between H1 and H2.

• The messages were broken down into chunks called datagrams.

  The process of breaking down a message into datagrams is called fragmentation and is the job of the Transport layer.

• Wireshark fills up with packets that make up that conversation. You can select each packet and examine it in detail.

• Each packet is a nested structure of headers. Each header implements one of the layers in the OSI model

  We call this encapsulation

• Each layer carries its own addresses, in its own format, and neither layer can read the other's. H1's MAC and H1's IP both identify H1 and have nothing to do with each other.

• Look at the byte count in the packet. It's mostly headers.

Fill this in

Select one HTTP packet and fill in this table with the details.

Ask if there is a term you don't understand.

Record

Worksheet section 3: the completed PDU table

If it went wrong