Programming Project 2: Analyzing packet traces (PCAP) CSE 310, Spring 2022 Teacher: Aruna Balasubramanian Due date: March 10 2022, 9.00pm The aim of this task is to dissect TCP packets. To do that, try to be accustomed to the packet codecs (PCAP recordsdata). Particularly, your aim is to parse a PCAP file. PCAP is the file format used to retailer packets captured on the wire. PCAP recordsdata are in binary format and can’t be learn immediately. A PCAP library is used to parse the binary packet. Your aim is to put in writing a parser that analyzes the packet with the Helpance of the PCAP library. TCPdump is the command-line instrument that additionally analyzes the packets captured on the wire. Wireshark is the graphical model of TCPDump. You’ll be able to try these instruments to see some examples of packet Assessment if you would like. Half A PCAP Programming Job and flow-level info (70 factors) Your activity is to put in writing a program analysis_pcap_tcp that analyzes a PCAP file to characterize the TCP flows within the hint. A TCP stream begins with a TCP “SYN” and ends at a TCP “FIN” between two hosts. A TCP stream is uniquely recognized by the tuple: (supply port, supply IP deal with, vacation spot port, vacation spot IP deal with). There will be a number of TCP flows on the identical time between the 2 hosts, on completely different ports. You should use a PCAP library to research this file. Instance PCAP libraries are supplied on the finish of this task. A PCAP library helps convert a PCAP packet from binary to byte format. It is advisable to then write code to research the bytes to get the details about the packet. [Important: You can create your own packet structures and read the bytes into the structure. This will let you easily parse the bytes rather than doing byte operations. You can also use the ethernet and TCP modules in the PCAP library to get these packets. However, you cannot convert the PCAP file into text for analysis.] Particularly, we’ve captured packets which might be happening the wire—both packets from the pc and to the pc. This packet seize is in PCAP format and referred to as assignment2.pcap within the useful resource part. On this file, we’ve captured packets despatched between 130.245.145.12 and 128.208.2.198. Node 130.245.145.12 establishes the connection (let’s name it sender) with 128.208.2.198 (let’s name it receiver) after which sends information. The hint was captured on the sender. Your “ analysis_pcap_tcp” code ought to take as enter any pcap file (however particularly ought to work with assignment2.pcap). You’ll be able to hardcode the sender and receiver IP addresses in your code. Your code ought to output the solutions to those questions (Ignore non-TCP site visitors):
● The variety of TCP flows initiated from the sender. A TCP stream begins with a SYN and ends with a FIN, and a TCP stream is recognized by a (supply port, supply IP deal with, vacation spot port, vacation spot IP deal with). A sender can provoke a number of TCP flows on the identical time.
● For every TCP stream
(a) Write down the (supply port, supply IP deal with, vacation spot port, vacation spot IP deal with) (b) For the primary two transactions after the TCP connection is about up (from sender to receiver), the values of the Sequence quantity, Ack quantity, and Obtain Window dimension. Within the determine under, the primary two transactions are marked in orange. If there’s a packet loss, this illustration ought to nonetheless work. If the final ACK within the three-way handshake is piggy-backed with the primary packet (in orange), then you need to nonetheless begin with this piggy-backed packet. (c) The sender throughput. I’m defining throughput as the full quantity of bytes despatched by the sender over a interval. The interval is the time between sending the primary byte to receiving the final acknowledgement. For throughput, solely think about the packets on the TCP stage (together with the header). You’ll be able to ignore all different headers and acks.
This is just one instance, your stream might look completely different Half B Congestion management (30 factors) Now lengthen your program so that it’ll output the next reply to the questions. For every TCP stream: (1) Print the primary three congestion window sizes (or until the top of the stream, if there are lower than three congestion home windows). The congestion window is estimated on the sender. It is advisable to estimate the congestion window dimension empirically for the reason that info just isn’t accessible within the packet. Touch upon how the congestion window dimension grows. Keep in mind that your estimation might not be good, however that’s okay. Congestion window sizes change at roughly RTT-intervals.
Sender Node 130.245.145.12
Receiver Node 128.208.2.198
SYN
SYN/AC Okay
ACK
cwnd=icwnd
(2) The variety of occasions a retransmission occurred attributable to triple duplicate ack and the variety of occasions a retransmission occurred attributable to timeout. Please notice that it is advisable analyze the packet and use some logic to find out when a packet is a triple duplicate ack and timeout. You can’t use a library (corresponding to PyShark) to get this reply. In uncommon instances, a packet could also be retransmitted even when there isn’t any triple duplicate ack (for that packet) or a timeout. Please notice these as properly in case you see them. Submission Instruction As earlier than, you might write your packages in Python or C/C++. If you wish to write in every other language, please speak to me. Viewing these traces on Wireshark will be useful. It is advisable to submit your homework in a single zip file as follows: • The zip file and (the basis folder inside) ought to be named utilizing your final title, first title, and the task quantity, all separated by a splash (‘-‘) e.g. lastname-firstname-assignment2.zip • The zip file ought to include (i) the high-level abstract of the analysis_pcap_tcp code together with the way you estimated the solutions to the questions in Half A and Half B, (ii) the analysis_pcap_tcp program, and (iii) directions on the way to run your code Some instance pcap libraries that you should utilize: C/C++ – libpcap Python – dpkt
