Goal:

• Learn how Internet protocol works.
• Learn to read  a protocol specification (HTTP1.1), interpret the basics protocol message format, including the header fields and message body.
• Learn how web client/server works .
• Learn how to use Ethereal to sniff and interpret packets.
• Learn why ssh is more secure than telnet.

Assignment Date: 8/21/2006
Due Day: Exercise 1-3 due 8/28/2006; Exercise 4 due 9/6/2006
Description:

• Create an web page <your login>.html with
• your recent photo with face big enough, scan and save it in JPEG as <your login>.jpg (I can take your picture also using my digital camera).
• short vita with at least email address.
• your interests in CS522
• See student web page examples in http://cs.uccs.edu/~cs525/CS525S2002Photo.html or http://cs.uccs.edu/~cs522/CS522S2002Photo.html
• Put this web page (these two files) in ~<your login>/public_html/cs522 on cs.uccs.edu. Make sure you use the right file name.
• Check the access permissions on these files, your public_html, and your home directory. Make sure they are read and executable by others (use "chmod 755").
• In your public_html directory, create a soft link from <your login>.html file to index.html using the following command:
  ln -s <your login>.html index.html
• Verify your web page works on a web browser, by typing http://cs.uccs.edu/~<your login>
• Email me the url of the web page.

Exercise 2. Understand HTTP 1.1 usig fake web server and web client.

In this exercise, you will first run a fake web serve using ~cs522/bin/ws to find out the http request sent by a browser. Then we will use telnet <domainname> <portno> as a fake browser to find out what is the http resposne of a web server.

Using a fake server to find out the http request

If we type in ~cs522/bin/ws 9338 on blanca.uccs.edu, then type in http://blanca.uccs.edu:9338/~cs401/ on a IE browser. We will see the following message on the console. The message received is the http request sent by the browser with http request command link "GET /~cs401/ HTTP/1.1" followed by 6 headers lines.

All header lines has header name followed by ":" then by the value of the header.
The Accept header indicates the type of file format accepted by the browser.
The Accept-Language header is en-us. It can be by the server to return the US English version of the web page.
The Accept-Encoding indicates the acceptable compression method.
The Use-Agent meta header indicates the versionof the browser that submitted the request. It may include the related OS version, SSL package number. Here it shows the browser is MS IE version 6.0 running on a machine with NT5.1 OS (XP).
To comply with HTTP/1.1 protocol, the browser needs to supply the Host header with the domain name and port number in the url entered by the user. Here it is blanca.uccs.edu:9338.
Connection header has value Keep-Alive, which means the browser requests the TCP connection to be kept alive for future http request. This feature reduces the 3-way handshake overhead for those future requests.

• The definition of these meta header can be found in http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.
• The form data submitted by the web browser are encoded in a special format called x-www-form-urlencoded, where all special characters are encoded as 3-character hexadecimal code representation.
• For detail of the HTTP 1.1 protocol specification, read http://www.w3.org/Protocols/rfc2616/rfc2616.html

blanca.uccs.edu> ~cs522/bin/ws 9338
ws 9338
argv[1]=9338
portno=9338
before getsockname socket has port #9338
socket has port #9338
rcvd msg-->GET /~cs401/ HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.0.2914; .NET CLR 1.1.4322)
Host: blanca.uccs.edu:9338
Connection: Keep-Alive

What is your reply ("#" to end multilineinput; "$" to break connection)?
HTTP/1.1 200 OK
Date: Mon, 18 Aug 2003 22:25:16 GMT
Server: Apache/2.0.40 (Red Hat Linux)
Last-Modified: Sun, 17 Aug 2003 18:06:53 GMT
ETag: "b4dc6a-3866-c01bc940"
Accept-Ranges: bytes
Content-Length: 18

<html>OHHHH</html>

The above interaction shows that when the fake web ask "what is your reply?" We type in the http response (pretend we are the web server). The First line is the http response line. The 200 is the response code, which indicate the web page is retrieve successfully. The remaining six headers indicate

Date: the date the response is created,
Server: the version of the server that returns the response
Last-Modified: indicates the web page last modified date
ETag: A hash value can be submitted in the future for verifying the version of document has been updated.
Accept-Range: bytes (HTTP1.1 only support bytes. A http request can use Range header to request portion of a document.)
Content-Length: indicates the the length of the attached document after the http response header. Here it is 18 bytes.
Note the the header and body are separated by two CRLF after the last http header.

• Run ~cs522/bin/ws on your directory with 8<last three digits of your SS#> as web server on sanluis.uccs.edu. Assume your last three digits of your SS# are 338. Lauch a web browser of your choice with the url
  http://sanluis.uccs.edu:8338/
  Enter the above response but replacing OHHH with "hello world!" and modify the content length accordingly.
• Find out the web browser version.

Using telent a fake web browser to find out the web server response

Use CS Unix machines or a Unix machine to carry the following exercise. The windows commond console will not take the following telnet command to port 80. Note that the web page last modified date was changed to 28 Oct 2003 instead 17 Aug 2003.

The following are the response of a web server capatured using "telnet cs.uccs.edu 80 > out.txt " and enter
GET / HTTP/1.0
<enter>
<enter>

Trying 128.198.162.68...^M
Connected to cs.uccs.edu.^M
Escape character is '^]'.^M
HTTP/1.1 200 OK
Date: Mon, 18 Aug 2003 22:25:16 GMT
Server: Apache/2.0.40 (Red Hat Linux)
Last-Modified: Sun, 17 Aug 2003 18:06:53 GMT
ETag: "b4dc6a-3866-c01bc940"
Accept-Ranges: bytes
Content-Length: 14438
Connection: close
Content-Type: text/html; charset=ISO-8859-1

<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Author" content="C. Edward Chow">
<meta name="GENERATOR" content="Mozilla/4.7 [en] (WinNT; I) [Netscape]">
<title>CS522 F2003 Home Page</title>
</head>
<body background="marble1.jpg">

• Make sure you kill the ws process after your exercise.

Exercise 4 Ethereal Packet Sniffing Exercise.

• Follow the step in "Capture FTP and SFTP sessions Using Ethereal" web page. Use ethereal XPvm1 (XP virtual machine) to capture packets of a telnet session and a ssh-base login session to wait.uccs.edu.
• Option: You can choose to download Ethereal to work at home pc and capature telnet and ssh login session to wait.uccs.edu, using cslab aslogin.
• Learn how to
  • set up packet filter and color filter on Ethereal, so that you can focus on specific packet streams, e.g. those to/from brain.uccs.edu.
  • set up Follow TCP stream so that you can examine the payload content of a sqeuence of TCP segments in a session.
• There is an old detailed steps of the exercise is in http://cs.uccs.edu/~cs522/ethereal/EtherealCapture.doc
• Investigate that the application leve content of several telnet session packets consists of plain text login, while the ssh-base login session the password and login are encrypted.
• Answer the four questions posted in etherealCapture.doc.
• Q4.1. How many TELNET packets is used to carry the login and how many are used to carry the password?
• Q4.2. Why TELNET does this way?
• Q4.3. For the TELENT session, what are the Src MAC address, Dst MAC address, Src IP address, Dst IP address, TCP Src Port, and TCP Dst Port number on the outgoing packets carrying the actual password? Hint: They are all the same.
• Q4.4. For the SSH Session, what are the Src MAC address, Dst MAC address, Src IP address, Dst IP address, TCP Src Port, and TCP Dst Port number on the outgoing packets carrying the Encrypted request packet?  Are these fields different from those in the Telnet session?

Include the above four answers as a homework file, titled hw1, (can be in web page, text file, or word document format) and email it to chow@cs.uccs.edu