Tools and Techniques for Simplifying the Analysis of Captured Packet Data.

1. INTRODUCTION The introductory networking essentials course that I co-teach with one of my colleagues includes a weekly lab session. I have developed a set of thirteen labs for this course (see http://telecomm.boisestate.edu/itm305l.fall.2008/). This teaching tip describes lab 10, which provides students with experience in capturing and analyzing data transferred over a TCP/IP network. Specifically the lab examines packets transferred from server to client during the download of a "large" file, approximately 1 megabyte in size, using FTP and TFTP. FTP transfers files in a reliable, connection-oriented fashion using TCP as its transport layer protocol, while TFTP transfers files using a connection-less approach supported by the UDP transport layer protocol. The purpose of the lab is to allow students to collect and analyze data so that they can visualize the differences in complexity of the two transport layer protocols, TCP and UDP. TCP is more complex than UDP. TCP clients establish logical connections to TCP servers before data transmissions take place. All data segments traverse the same logical path between sender and receiver. TCP segments consist of a TCP header and a payload that contains application data. TCP uses a sliding window protocol to determine segment sizes. Acknowledgements are sent after segments have been received (Liebeherr and El Zarki, 2004). UDP is a very simple protocol. UDP adds a small header to application data. The result is called a UDP datagram. When a UDP datagram is transmitted, it is encapsulated with an IP header and delivered using a connection-less approach, i.e., datagrams take whichever path is available from sender to receiver on the network. A separate acknowledgment is sent for each datagram that is received (Liebeherr and El Zarki, 2004). In general, one might expect that a UDP transfer would take more time than the equivalent TCP transfer, because of the additional number of acknowledgements transmitted by UDP. On the other hand, since TCP must establish a virtual connection between sender and receiver, and supports numerous functions that UDP does not, one might expect that this additional overhead would make TCP transfers slower than UDP transfers. This lab is designed to instruct students on the use of tools and techniques that will help them determine how the features of each protocol affect its performance. Students learn how to use the Wireshark packet analyzer and the UNIX grep command to capture and analyze data to help them determine performance differences in TCP and UDP protocols. Wireshark (http://www.wireshark.org/) is a free program that can be configured to capture all network packets sent to a computer. The grep command is a filtering program that can quickly extract data subsets from large data files. Grep was originally a UNIX utility, but Windows versions are now available at http://gnuwin32.sourceforge.net/packages/grep.htm. 2. PROCEDURES 2.1 UDP File Transfers Students begin by configuring Wireshark to capture all packets sent to their client computer. While Wireshark runs in the background, students start a TFTP session and download a "large" one megabyte file stored on a TFTP server. After downloading the file, students stop the Wireshark capture and answer a set of questions pertaining to the number, size, and content of the packets captured, and calculate the actual time required to download the file (Liebeherr and El Zarki, 2004). 2.2 TCP File Transfers The procedure required for the FTP download is similar to that used for TFTP file transfers. Students start a Wireshark capture, login to the FTP server, and download the "large" file. When the download is complete, students stop the capture and answer a set of questions similar to the TFTP question set described above. Detailed instructions for this part of the lab are available at: http://telecomm.boisestate. …