1. 3. Protocol Analysis
Objectives
Protocol Analysis
Hands On

2. Protocol Analyzer Summary Detail Hex Dump
Start Sniffer (upper right corner)
File Open – Snmp1.cap
Maximize Window

3. Hands on 1(4)
What community name is used for communication with destination address
a) for read access?
b) for write access?
c) who is (sysObjectID)?
What value (hex) is used for the datatype TimeTicks?
(remember Tag-Length-Value)
ardbeg
bowmore
Microsoft (311) 43

4. Hands on 2(4) 3. Packet no 10 is an Authentication Failure Trap
a) why is this trap sent?
b) who is the target (address and port)?
c) who (IP address) is not authorized?
d) who (vendor) is sending the trap?
bad community or access-list
, 162
cisco

5. Hands on 3(4)
4. Packet no 13 is a GetBulk Request asking a Cisco router for ifDescr
a) how many instances is requested?
b) how many instances had been optimal to request?
if we use GetNext, how many GetNext + Response packets must be sent?
why is packet no 14 sent? 15 10 22
unknown engine id

6. Hands on 4(4)
5. Packet no 19 is also a GetBulk Request. In this request we ask a windows computer for installed programs
a) how many instances is requested?
what happens?
6. Packet no 92 is a Cold Start Trap
a) why is this trap sent? 35
IP fragmentation (> 1514 byte)
router restarted from console