Midterm 2, 04/02/2005.

My philosphy is that while a certain amount of memorization of 
``dry facts'' is necessary, it is a necessary evil. The stress is 
on understanding ``structures'' so that facts make so much sense
that they are easy to remember or, preferably, easy to reconstruct 
when needed.

I expect you to have ``total recall'' on:

Ethernet frame header,
IP header without options,
UDP header and pseudo header,
TCP header and pseudo header, without options.
    But I do not expect you to be able to reproduce the exact 
    locations of the control flags in the TCP header.
    You must understand what they mean and do.

About options (IP and TCP): you must understand them thoroughly, 
but I do not expect you to remember the ``kind'' codes. 
(Or ``Codes'' in IP.)
So for example I do not expect you to remember that the MSS option has 
kind = 2.
But I do expect you to either remember, or, preferably(!), deduce in
1 second, that the MSS option has length 4.
(The MSS in theory can be almost 65495 bytes, so 16 bits are required, 
so the MSS option has a ``kind'' byte, a ``Length'' byte, and 2 bytes 
for the MSS: total 4 bytes.)
You must know how ``lengths'' and ``pointers'' etc are used in various 
options. 

I expect you to thoroughly understand the ARP and RARP packets, ICMP
packets, IGMP packets, etc, but I do not expect total recall.
I certainly do not want you to memorize kinds and codes and types etc.
These are details that in real life you look up when needed. In an exam
they are provided if needed (and often when not needed).

Use previous exams as guideline.

There  WILL  be a ``tcpdump'' type question.
There is likely to be a ``header of tcp packet'' type question,
but that could be part of a tcpdump question.

You must be able to translate between decimal and hexadecimal and binary.

I do not want you to memorize the hex <-> ASCII translation table!
(Sorry to even mention it: a student asked.)
If you need it I will give it.

You should remember that IPv4 is version 4, IPv6 is version 6, 
ethertype 0800 is IPv4, protocol 6 is TCP, protocol 17 is UDP, 
port 80 is http.

I do not expect you to further memorize ethertypes, protocol numbers,
port numbers, etc.

I like questions where you have to combine information from say a 
tcpdump output and an arp or ifconfig (etc) output to get the answer.

Good Luck. Work hard. Teun Ott.