of two parts.The packet capture library receives a copy of every link-layer frame that is sent from or received by your computer.Recall from the discussion from section 1.5 the text(Figure 1.24)that messages exchanged by higher layer protocols such as HTTP, FTP,TCP,UDP,DNS,or IP all are eventually encapsulated in link-layer frames that are transmitted over physical media such as an Ethernet cable.In Figure 1,the assumed physical media is an Ethernet,and so all upper-layer protocols are eventually encapsulated within an Ethernet frame.Capturing all link-layer frames thus gives you all messages sent/received from/by all protocols and applications executing in your computer. packet sniffer application apoeene8ew Transport(TCP/UDP) Network (IP) Link (Ethernet) Physical Figure Packet sniffer structure The second cc ent of a packet sniffer is the packet analyzer,which displays the nts rde analyz stan str f all d by prote ols Fo este hag the rious y the et analyz nds of Etp erne rames,and so can identify the datagram thin an Etheret f so understands the IP datagram format,so that it can extract the TCP segment with the IP datagram Finally,it understands the TCP segment structure,so it can extract the HTTP message contained in the TCP segment.Finally,it understands the HTTP protocol and so,for example,knows that the first bytes of an HTTP message will contain the string"GET," POST,”or“HEAD,”as shown in Figure2.8 in the text. We will be using the Wireshark packet sniffer [http://www.wireshark org/]for these labs allowing us to display the contents of messages being sent/received from/by protocols at different levels of the protocol stack.(Technically speaking.Wireshark is a packet analyzer that uses a packet capture library in you omnute )Wireshark is a free network protocol analyzer that runs on Windows.Linux/Unix,and Mac computers.It's an ideal acket analyer for our absit has a lare ser hase and y support that includes user-guide (http:/www.wireshark org/docs/wsug html_chunked/ hehd: of two parts. The packet capture library receives a copy of every link-layer frame that is sent from or received by your computer. Recall from the discussion from section 1.5 in the text (Figure 1.241 ) that messages exchanged by higher layer protocols such as HTTP, FTP, TCP, UDP, DNS, or IP all are eventually encapsulated in link-layer frames that are transmitted over physical media such as an Ethernet cable. In Figure 1, the assumed physical media is an Ethernet, and so all upper-layer protocols are eventually encapsulated within an Ethernet frame. Capturing all link-layer frames thus gives you all messages sent/received from/by all protocols and applications executing in your computer. operating system application packet capture (pcap) copy of all Ethernet frames sent/received application (e.g., www browser, ftp client) Transport (TCP/UDP) Network (IP) Link (Ethernet) Physical packet analyzer packet sniffer Figure 1: Packet sniffer structure to/from network to/from network The second component of a packet sniffer is the packet analyzer, which displays the contents of all fields within a protocol message. In order to do so, the packet analyzer must “understand” the structure of all messages exchanged by protocols. For example, suppose we are interested in displaying the various fields in messages exchanged by the HTTP protocol in Figure 1. The packet analyzer understands the format of Ethernet frames, and so can identify the IP datagram within an Ethernet frame. It also understands the IP datagram format, so that it can extract the TCP segment within the IP datagram. Finally, it understands the TCP segment structure, so it can extract the HTTP message contained in the TCP segment. Finally, it understands the HTTP protocol and so, for example, knows that the first bytes of an HTTP message will contain the string “GET,” “POST,” or “HEAD,” as shown in Figure 2.8 in the text. We will be using the Wireshark packet sniffer [http://www.wireshark.org/] for these labs, allowing us to display the contents of messages being sent/received from/by protocols at different levels of the protocol stack. (Technically speaking, Wireshark is a packet analyzer that uses a packet capture library in your computer). Wireshark is a free network protocol analyzer that runs on Windows, Linux/Unix, and Mac computers. It’s an ideal packet analyzer for our labs – it is stable, has a large user base and well-documented support that includes a user-guide (http://www.wireshark.org/docs/wsug_html_chunked/), 1 References to figures and sections are for the 6th edition of our text, Computer Networks, A Top-down Approach, 6th ed., J.F. Kurose and K.W. Ross, Addison-Wesley/Pearson, 2012