Network Analysis Tools and Techniques

The assignment delves into the usage and understanding of various network analysis tools. Students analyze packet captures using tcpdump, examine network connections with netstat, and utilize tracert to trace network paths. The assignment covers interpreting packet headers, analyzing connection states (listening, established, close_wait), and identifying devices along a network path.

COIT20261 Network Routing and Switching (Term 1, 2018)
Assignment item —Written Assessment-1
Due date:
11:45pm AEST, Friday, Week 6
ASSESSMEN
T
Weighting: 15% 1
Objectives
This assessment task requires you to demonstrate your knowledge of basic routing concepts
by completing a number of exercise questions. The questions contain numerical as well as
descriptive questions covering the material up to Week 6.
The questions are designed to help you to achieve the unit learning outcomes as listed in the
unit profile.
Instructions
You must do this assignment on your own – it is not a group assignment.
Type all your answers in the ‘Template for Your Answers’ Section of this document and
upload only that template. You could do that by copying the Template section into a new
Word document for uploading. Answers that are not typed into the “Template for Your
Answers” section may not be marked, or may be returned to you for re-typing and re-
submission – late penalties will apply.
Where instructed, you must show the steps you took to arrive at your answers. Write
your answers in your own words to avoid potential plagiarism and copyright violations.
You must submit the Answer section as a Word file (.doc or .docx). Do not submit PDF’s
or any other type of file without express permission from the Unit Coordinator.
Plagiarism Procedures can be found in the CQUniversity Policies section of the Unit Profile.
Assessment Requirements and Marking Criteria
There are 3 main questions with some sub-questions and the requirements are stated for each
one. You must answer all questions and their sub-questions. Marks are indicated in the
Answer Template.
The questions will be marked on correctness, logic and clarity, and addressing all parts of the
question.
The Assignment Questions begin on the next page.
USE THE PROVIDED TEMPLATE ON P.4 FOR ALL YOUR ANSWERS.

COIT20261 Network Routing and Switching (Term 1, 2018)
Assignment item —Written Assessment-1
Question 1 – Address usage (3 marks)
Consider the following classless address block:
154.78.177.3/27
List the addresses from this block that would be used as:
a) the network address,
b) the direct broadcast address, and
c) the range available for hosts to use
Show the steps you took to arrive at your answers.
Question 2– Allocating subnets from a block (8 marks)
A company has been granted a block of addresses which includes the address
138.77.216.5/24. Answer the following questions, showing your calculations.
a) Calculate the network address of this block and how many host addresses
including special addresses this block can provide (1 mark)
b) Create the following 6 subnets for this company by calculating the subnet
address for each subnet. Answer this question by filling in the table in the
Answer template. Use CIDR format for the mask.
I. 2 subnets with 32 addresses each (2 marks)
II. 4 subnets with 16 addresses each (4 marks)
c) After some time, the company decides that it wants another subnet with 1,024
addresses. Explain whether this can be allocated from the existing block.
(1 mark)
Question 3 – Network Tools (Windows) (4 marks)
Often the best way to gain an initial familiarity with network tools is to simply use them, at a
basic level in exploratory mode as suggested in some of the tutorial exercises. Netstat and
Tracert are included in Windows, while Wireshark is free to download and install. Explore
Wireshark, Netstat and Tracert, then complete this question.
a) A wireshark scan has produced a packet capture, saved to a file named
wireshark_capture01.pcapng and available on the Unit website. Download the file
and open it in Wireshark, then answer these questions about the scan:
i. Very briefly summarise in your own words the content in each of the three
horizontal display windows in Wireshark (.5 mark)
ii. In Frame 3, what brand of computer launched this scan and what was its IP
address? State where this information is found (.5 mark)
iii. Briefly explain the exchange event captured in frames 4 - 6 (.5 mark)

COIT20261 Network Routing and Switching (Term 1, 2018)
Assignment item —Written Assessment-1
iv. Describe in your own words two specific network problems that a network
administrator could use Wireshark for as a troubleshooting tool? (.5 mark)
b) A ‘NETSTAT –aon’ command has given the output below (excerpted). Briefly
describe each column heading, and the states LISTENING, ESTABLISHED and
CLOSE_WAIT. (1 mark)
Active Connections
Proto Local Address Foreign Address State PID
TCP 10.0.0.58:139 0.0.0.0:0 LISTENING
TCP 10.0.0.58:5040 0.0.0.0:0 LISTENING 7480
TCP 10.0.0.118:139 0.0.0.0:0 LISTENING 4
TCP 10.0.0.118:52450 52.63.165.133:443 ESTABLISHED 14080
TCP 10.0.0.118:52458 104.116.191.195:443 CLOSE_WAIT 8912
TCP 10.0.0.118:52791 40.100.151.2:443 ESTABLISHED 22400
TCP 10.0.0.118:52811 162.125.34.129:443 ESTABLISHED 4696
TCP 10.0.0.118:52820 34.232.224.128:443 CLOSE_WAIT 4696
TCP 10.0.0.118:52879 162.125.34.129:443 ESTABLISHED 4696
...
c) Do a TRACERT on your computer to www.google.com. Paste the output to your
assignment answer template and discuss the information being displayed (1 mark)

COIT20261 Network Routing and Switching (Term 1, 2018)
Assignment item —Written Assessment-1
TEMPLATE FOR YOUR ANSWERS
Type your answers in this section in the spaces provided
First Name:_________________________ Last Name:_________________________
Student ID: __________________________
Question Number Mark
allocated
Mark
earned
Question 1: (3 marks) 3
a)
b)
c)
Network address 154.78.177.0
Direct broadcast address 157.78.177.31
Range for hosts 154.78.177.0 – 157.78.177.31
1 mark
each
item,
total 3
Question 2: (8 marks) 8
a) Network address 138.77.216.0
Host addresses 30
1
b) Subnet No. addresses Subnet address Mask /n
1 32 138.77.216.0 –
138.177.216.31
255.255.255.224/
27
2 32 138.77.216.32 –
138.77.216.63
255.255.255.224/
27
3 16 138.77.216.0-
138.77.216.15
255.255.255.240/
28
4 16 138.77.216.16-
138.77.216.31
255.255.255.240/
28
5 16 138.77.216.32-
138.77.216.63
255.255.255.240/
28
6 16 138.77.216.64-
138.77.216.127
255.255.255.240/
28
6
c) Yes this is possible. This can be achieved by subnetting using
138.77.216.5/22
1
Question 3: (4 marks) 4
a)
i) The top window displays the packet list, it shows all the packets that
.5 mark
each

COIT20261 Network Routing and Switching (Term 1, 2018)
Assignment item —Written Assessment-1
ii)
iii)
iv)
have been captured during the process. It displays the source of the
packets destination and protocol used
In the second window it shows the headers of all the packets
The first line shows the entire frame of the network. It displays the
physical layer header
second line shows the IP packet header.
The third line shows the UDP segment header
Fourth line shows the application layer information
The computer that launched the scan was a HP 24 with IP address
138.77.216.88. The computer type can be found on window two the
ethernet line while the IP address is found on the internet protocol line
The server responds to the client. The server hello contains a session
identifier to identify the session corresponding with the client
connection. If the session ID in the client hello message is not empty, the
server will find a match in the session cache. If a match is found and the
server wants to use the same session state, it returns the same ID as sent
by the client. If the server doesn’t want to resume the same session, then
a new ID is generated. The server can also send an empty ID, indicating
the session cannot be resumed.
Server certificate. The server authenticates itself to the client by sending
a certificate which contains its public key. After the certificate is verified
the client then can initiate a connection with the server.
The server Hello done indicates the server is done and is awaiting the
clients response
Can be used to troubleshoot the slowness of a network. When you open
the expert information, you can view whether the network has some
errors in it or not. Also, you can view the network traffic and
determining which computers are using a high bandwidth
Can be used to analyse http traffic. It can see the requests to the servers
and also see the responses to the client from the server
item,
total 2
for 3a.
b) The command netstat -aon
‘a’ displays all connections as well the ports being listened to
‘o’ displays all process identifiers (PID) associated with each connection
‘n’ displays addresses and port numbers in numerical form
Proto is the protocol used, in this case TCP
Listening state means that the server is ready to accept any connection
Established state means that the server has received a signal from the
client and the connction has been set up
Close_wait means that the server has received the first signal from the
client and the connection is in the process of being closed
1
c) 1

COIT20261 Network Routing and Switching (Term 1, 2018)
Assignment item —Written Assessment-1
Here tracert identified 8 devices in which my computer communicated
with to reach the destination which is google.
The first device is the router on my network
Devices 2 to 7 are the servers in which the data passes through
Device number 8 is the destination
Total marks awarded 15 (max)
Less late penalties if applicable
Less plagiarism penalties if applicable
Total marks earned
Markers comments: