packet2_ch6(wireshark数据包分析实战第六章英文版).pdfVIP

C O M M O N L O W E R - L A Y E R P R O T O C O L S Whether troubleshooting latency issues, identifying malfunctioning applications, or zeroing in on security threats in order to be able to spot abnormal traffic, you must first understand nor- mal traffic. In the next couple of chapters, you’ll learn how normal network traffic works at the packet level. We’ll look at the most common protocols, including the workhorses TCP, UDP, and IP, and more commonly used application-layer protocols such as HTTP, DHCP, and DNS. Each protocol section has at least one associated capture file, which you can download and work with directly. This chapter will specifically focus on the lower-layer protocols found in reference to layers 1 through 4 of the OSI model. These are arguably the most important chapters in this book. Skipping the discussion would be like cooking Sunday supper without cornbread. Even if you already have a good grasp of how each protocol functions, give these chapters at least a quick read in order to review the packet structure of each. Practical Packet Analysis, 2nd Edition © 2011 by Chris Sanders Address Resolution Protocol Both logical and physical addresses are used for communication on a network. The use of logical addresses allows for communication between multiple networks and indirectly connected devices. The use of physical addresses facilitates communication on a single network segment for devices that are directly connected to each other with a switch. In most cases, these two types of addressing must work together in order for communication to occur. Consider a scenario where you wish to communicate with a device on your network.