0. 实验文件地址
Wireshark Lab: Ethernet and ARP v7.0
数据字段（46~1500字节）：这个字段承载了IP数据报。以太网的最大传输单元（MTU）是1500字节。
目的地址（6字节）：这个字段包含目的适配器的MAC地址。
源地址（6字节）：这个字段包含了传输到该帧到局域网上的适配器的MAC地址。
类型字段（2字节）：类型字段允许以太网复用多种网络层协议。
CRC（4字节）：CRC（循环冗余检测）使得接收适配器的检测帧中是否引入了差错。
前同步码（8字节）：以太网以一个8字节的前同步码字段开始（前同步码请自行百度）。
1. Capturing and analyzing Ethernet frames
Question & Answer
1. What is the 48-bit Ethernet address of your computer?
2. What is the 48-bit destination address in the Ethernet frame? Is this the Ethernet address of gaia.cs.umass.edu? (Hint: the answer is no). What device has this as its Ethernet address? [Note: this is an important question, and one that students sometimes get wrong. Re-read pages 468-469 in the text and make sure you understand the answer here.]
这个目的MAC地址是路由器接口的地址。如果是目的主机的MAC地址，那么源主机所在的子网上的所有适配器都不会费心将IP数据报传递到它的网络层。
3. Give the hexadecimal value for the two-byte Frame type field. What upper layer protocol does this correspond to?
4. How many bytes from the very start of the Ethernet frame does the ASCII “G” in “GET” appear in the Ethernet frame?
前3行都是16字节，第4行到0x47有7个字节，总共55个字节。
5. What is the value of the Ethernet source address? Is this the address of your computer, or of gaia.cs.umass.edu (Hint: the answer is no). What device has this as its Ethernet address?
这个MAC地址是路由器的接口地址。
6. What is the destination address in the Ethernet frame? Is this the Ethernet address of your computer?
这个MAC不是源主机的，而是源主机所在子网的路由器的接口地址。
7. Give the hexadecimal value for the two-byte Frame type field. What upper layer protocol does this correspond to?
8. How many bytes from the very start of the Ethernet frame does the ASCII “O” in “OK” (i.e., the HTTP response code) appear in the Ethernet frame?
14个字节。
2. The Address Resolution Protocol
9. Write down the contents of your computer’s ARP cache. What is the meaning of each column value?
10. What are the hexadecimal values for the source and destination addresses in the Ethernet frame containing the ARP request message?
11. Give the hexadecimal value for the two-byte Ethernet Frame type field. What upper layer protocol does this correspond to?
12. 
a. How many bytes from the very beginning of the Ethernet frame does the ARP opcode field begin?
可以从上图看出，opcode之前有20个字节。
b. What is the value of the opcode field within the ARP-payload part of the Ethernet frame in which an ARP request is made?
如上图所示，opcode为0x0001。
c. Does the ARP message contain the IP address of the sender?
d. Where in the ARP request does the “question” appear – the Ethernet address of the machine whose corresponding IP address is being queried?
从opcode可以看出，request。
13. Now find the ARP reply that was sent in response to the ARP request.
a. How many bytes from the very beginning of the Ethernet frame does the ARP opcode field begin?
在opcode之前有20个字节。
b. What is the value of the opcode field within the ARP-payload part of the Ethernet frame in which an ARP response is made?
如上图所示，opcode的值为0x0002。
c. Where in the ARP message does the “answer” to the earlier ARP request appear – the IP address of the machine having the Ethernet address whose corresponding IP address is being queried?
14. What are the hexadecimal values for the source and destination addresses in the Ethernet frame containing the ARP reply message?
15.
查询APR报文是在广播帧中发送的（子网中的所有电脑都能收到），而响应APR报文在一个标准帧中发送（只有发送请求的那台电脑能收到）。
原文地址：http://www.cnblogs.com/astralcon/p/16792665.html
1. 本站所有资源来源于用户上传和网络，如有侵权请邮件联系站长！
2. 分享目的仅供大家学习和交流，请务用于商业用途!
3. 如果你也有好源码或者教程，可以到用户中心发布，分享有积分奖励和额外收入！
4. 本站提供的源码、模板、插件等等其他资源，都不包含技术服务请大家谅解！
5. 如有链接无法下载、失效或广告，请联系管理员处理！
6. 本站资源售价只是赞助，收取费用仅维持本站的日常运营所需！
7. 如遇到加密压缩包，默认解压密码为"gltf",如遇到无法解压的请联系管理员！
8. 因为资源和程序源码均为可复制品，所以不支持任何理由的退款兑现，请斟酌后支付下载
声明：如果标题没有注明"已测试"或者"测试可用"等字样的资源源码均未经过站长测试.特别注意没有标注的源码不保证任何可用性
