CIS 456                         Name on  every sheet!
Quiz, 04/16/2004
20 minutes.

On Sunday April 11, 2004 Dr Ott took some tcpdump measurements on hawking 
(10.7.0.1 in the Internet Lab). One of the packets he saw was:

18:35:18.397430 0:2:b3:d3:d4:86 ff:ff:ff:ff:ff:ff 0806 42: arp who-has
10.7.0.253 tell 10.7.0.1
			 0001 0800 0604 0001 0002 b3d3 d486 0a07
			 0001 0000 0000 0000 0a07 00fd

1. What time was this packet observed? 
2. What is the source physical address? 
3. What is the destination physical address?
4. What do the  ``0806'' and ``42'' in the first line  stand for?
5. Do you know the physical address of the computer with IP address
   10.7.0.253 ? If you do, what is it?
6. Do you know the physical address of the computer with IP address
   10.7.0.1 ? If you do, what is it?
7. What can you say about the physical address ff:ff:ff:ff:ff:ff ?
   What kind of address is it?

Another packet Dr Ott saw was (only the hexadecimal out output is given!):

			 4500 003c ed2e 4000 4006 f667 0a07 0001
			 80eb cc32 be53 0025 daf4 22cd 0000 0000
			 a002 16d0 4ce4 0000 0204 05b4 0402 080a
			 010f cfe3 0000 0000 0103 0300

This happens to a TCP-SYN packet. (In fact, an ``original SYN'', with the 
ACK flag  NOT  set).

8. What is the size of the IP header?
   (Either in Bytes or in 32-bit words, make sure to say which one you
   mean!)
9. What is the size of the TCP header. (Either in ... , etc).
10. What is the TTL of this packet? Give the answer in hexadec  AS WELL AS
    in decimal.
11. What is the destination IP address of this packet?
    (of course, in dotted decimal!).