PACKET ANALYSIS WITH WIRESHARK DHCP, DNS, HTTP Chanhyun park

DHCP Dynamic Host Configuration Protocol Standardized network protocol for dynamically distributing network configuration parameters such as IP address Computers get IP address and networking parameters from a DHCP server Subnet mask, router, domain name server Packet format is well described in WIKI tocol tocol

DHCP – sequence DHCP Discover DHCP Offer DHCP Request DHCP Ack Search DHCP server DHCP server replies with available IP address Server allocate IP address for client with options and update IP address database Client select one DHCP server, request IP address and networking parameters Client start with DHCP Request when there is already DHCP IP

DHCP – sequence DHCP Discover DHCP Offer DHCP Request DHCP Ack Client start with DHCP Request when there is already DHCP IP

DNS Domain Name System

DNS Domain Name System Google.com ->

DNS Ethernet IP UDP

DNS message format 1 byte2 byte3 byte4 byte IdentifierFlag Num of QuestionsNum of Answers Num of AuthoritiesNum of Additional Records Questions Answers Authorities Additional Records

DNS message format 1 byte2 byte3 byte4 byte Identifier: 0x804bFlag: 0x0100 Num of Questions: 1Num of Answers: 0 Num of Authorities: 0Num of Additional Records: 0 Questions: type A, class INwww.facebook.com Answers Authorities Additional Records

HTTP HyperText Transfer Protocol Application protocol for distributed, collaborative, hypermedia information systems – version – version 1.1

HTTP Request Line – method, URI HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT Header Fields General, Request / Response, Entity Name, :, values Message Body

HTTP – Wireshark results daum.net

Question?