p.1

1
?? ????????????
NetGuru by NetSmooth Corporation
PART I TCP/IP????????/?NetGuru??
??? ???Packet????Ethereal
2
Overview

• Ethernet??
• Ethernet ????
• Hub?Ethernet Switch
• Ethereal??
• ????
• ?? 3.1 ??Ethereal????
• ?? 3.2 ??Hub?Ethernet Switch???

3
Ethernet??
4
The IEEE 802.3 Standard (Ethernet)

• ?IEEE 802?????OSI??????????????
• ??????OSI?????,??????????????,??? Media Access
  Control(MAC)?Logic Link Control(LLC)
• ????????????????
• ?????????
• ????,??????

5
Ethernet ???
6
Ethernet ??
?? ?? Data Rate ?? ???? ????
10BaseT IEEE 802.3 10 Mbps Star 100m UTP Category 5
100BaseT 100BaseTX 100BaseFX IEEE 802.3u IEEE 802.3x 100 Mbps Star UTP 100m Single Mode Fiber 20km UTP Category 5 or Single Mode Fiber
1000BaseTX 1000BaseFX 1000BaseCX IEEE 802.3z IEEE 802.3ab 1000 Mbps Star UTP 100m Single Mode Fiber 3km Coaxial Cable 25m UTP Category 5 or UTP Category 6 or Single Mode Fiber
7
Ethernet ????
8
Frame ??? Packet ??
9
Ethernet Frame
10
????(Encapsulation)
11
Frame ??? CSMA/CD

• Ethernet???????(shared medium),???????????????????
  ?,?Ethernet????CSMA/CD
• CSMA/CD - Carrier Sense Multiple Access with
  Collision Detection
• ????????? Frame ???????
• ??????? Cable ??????? Frame (Carrier Sense)
• ???????,???? Frame,???????????? Frame (Collision
  Detection)
• ?????,??? Random ?????,??? ( Backoff Algorithm)

12
CSMA/CD ????
13
Hub ? Ethernet Switch
14
Hub ? Ethernet Switch

• Hub
• PC1 ??? PC2,?? HUB ?????????,????????
• Ethernet Switch
• PC1 ??? PC2,? Port 1 ????,Ethernet Switch
  ????????????? Port 2 ???? PC2
• ?? PC3 ? PC4 ????????

15
Ethernet Switch ???????

• Ethernet Switch ?? Port ????? CSMA/CD ? Protocol
• Ethernet Switch ???????????? Port ?(????? Port
  ??)??? ARP????
• Ethernet Switch ??????????MAC Address ?? Port ???
• Ethernet Switch ??????? Port ? MAC Address
  ?????,????????? Ethernet Frame ?? Source MAC
  Address ????
• Ethernet Switch??????? ???????Frame

16
Broadcast Domain ? Collision Domain

• Broadcast Domain
• Broadcast Packet ????????
• Collision Domain
• ?? Hub ?????,?Packet????????

17
Ethereal??
18
Ethereal

• ????????
• ???????? Protocol ???
• ????? Promiscuous ?????????????
• ?? pcap(packet capture) library ???????????

19
?????
20
Filter ???

• ?????????????
• ?ip.addr 192.168.0.3
• ?????
• ?????

21
Filter ??

• ???IP Address?192.168.0.83ip.addr eq
  192.168.0.83
• ???IP Address?192.168.0.83?port?23(ip.addr eq
  192.168.0.83) and (tcp.port eq 23)
• ????????ARP?UDParp or tcp
• ???ARP Table???Source MAC??arp.src.hw_mac
  00d059a5d176
• ?????????http//www.ethereal.com/ethereal-filter.
  4.html

22
??Filter

• ??Ethereal??????Filter??
• ??Add Expression???????-gtAccept-gtOK
• ??Capture-gtStart

23
(No Transcript)
24
Ethereal ????

• ??????? Collision Domain ?????? frame ( Hub ?????)

25
????

• ?? 3.1 ??Ethereal????
• ?? 3.2 ??Hub?Ethernet Switch???

26
?? 3.1 ??Ethereal????

• ????
• ??Ethereal???????
• ??Ethereal????
• ??Packet?Ethernet Frame

27
?????
28
Step 1 ?Host A?Host B??Ethereal

• ??Ethereal,?Capture???Start
• Interface??eth0,??promiscuous mode
• ??name resolution ,???????

29
Step 2 ?Host A ping Host C,????????

• Host A
• ping -c3 192.168.0.3
• ???????
• ????????
• ???Host A?Host B?Ethereal??Stop,??????
• ???Host A?Host B??????
• ?????
• ?????Host A eth0??????Host B eth0?????,?????????
• ????????promiscuous mode????????
• ???Host B???????????(??eth1 ? eth2),?????????????
  ??

30
?? 3.2 ??Hub?Ethernet Switch???

• ????
• ??Hub?Ethernet Switch???
• ??broadcast domain?collision domain???

31
?????
32
Step 1 ??????

• ??NetGuru????host
• Host A
• ifconfig eth0 192.168.0.4 netmask 255.255.255.0
• Host B
• ifconfig eth0 192.168.0.5 netmask 255.255.255.0
• Host C
• ifconfig eth0 192.168.0.6 netmask 255.255.255.0

33
Step 2 ?Collision Domain???

• NetGuru?? Host B ?NetGuru?? Host B
• ??Ethereal,interface?eth0?????????
• ?NetGuru??Host A ping 192.168.0.3(NetGuru??Host
  C)
• ????Ethereal???????,???? ICMP??????? ARP???????

34
Step 3 ?Broadcast Domain??Collision Domain???

• NetGuru?? Host B ?NetGuru?? Host B
• ??Ethereal,interface?eth0?????????
• ?NetGuru??Host A telnet 192.168.0.6
  (NetGuru??Host C)
• ????Ethereal???????,???? ICMP??????? ARP???????
• ?????
• ???????Broadcast Domain?Collision Domain