Introduction§

This lab is all about common Unix networking tools. We've seen several in class already, so we will dive in a bit deeper here. The primary goal is to become familiar with the tools, their common uses, and the underlying networking concepts that they make visible.

Acknowledgments§

This assignment borrows from several of Janet Davis' CSC 364 labs. Specifically, it draws on Labs 6, 7, and 8 from that course. Some of those, in turn, borrow from other sources as acknowledged on those pages.

Goals§

Assignment§

Important: All of these parts should be completed when logged into sun.iwu.edu via SSH, unless otherwise noted. Sun.iwu.edu has the most interesting network configuration and activity of any host to which we have easy access. If you have access to another Unix host and you'd prefer to investigate these tools and their results there instead, let me know and I can okay that. The manpages to which this lab refers are those on sun.iwu.edu, and they may differ on other hosts.

As always, come see me, post to the discussion forum, or send an email if anything is unclear.

Part A: ifconfig§

  1. Read the manpage for ifconfig, focusing on the Description section. What is it used for? What does it do if it is invoked without any arguments?
  2. Run ifconfig with no arguments. Copy the results into your lab report.
  3. Choose an interface other than the local loopback. On sun.iwu.edu, there will only be lo and eth0.
    1. What is the maximum transmission unit (MTU) for this interface?
    2. Using the number of packets and bytes received and transmitted, compute the average size of packets received and the average size of packets transmitted. How do these compare to the MTU?
    3. Use the uptime command to determine how long the host has been running since it last booted. What are the average RX and TX rates (in bytes per second) for this host?
    4. How many collisions have been reported for this interface? It is most likely 0, but check. How could there have been zero collisions, given how many packets have been transmitted over this interface?

Part B: netstat§

  1. Read the manpage for netstat, focusing on the Description section. What is it used for?
  2. Run netstat -i. Copy the results into your lab report. How do these results compare with what you learned from ifconfig?
  3. Run netstat -t -u. Copy the results into your lab report (if there are more than ten lines, just copy the first ten or so lines).
    1. What do those two options, -t and -u, do?
    2. What services have active TCP connections on this host?

    Xtreme Unix Shell Tricks (for your edification, nothing more):
    netstat -t -u | grep ESTABLISHED | cut -d ':' -f 2 | cut -d ' ' -f 1 | sort | uniq
    The | operator is called "pipe", and it's the character above the backslash on your keyboard. In the shell, it redirects the output of one command into the input of another. Try to build up this line one command at a time, from left to right, to learn what each additional command does.

  4. Run netstat -t -u -l. Copy the results into your lab report (if there are more than ten lines, just copy the first ten or so lines).
    1. What does the added -l option mean?
    2. What network servers are running on this host? (Server software, that is; e.g. an HTTP server or an SMTP server. Realize that a single host may be running many servers at once, as they all can coexist on one machine without interfering with each other.) If there are more than ten, just list ten or so.
  5. Investigate the output of running netstat -r. Interpret and briefly describe the information it produces. (Do interpret it; don't simply report what you see. See the Output section of man route or ask me if you're not sure what you're seeing.)

Part C: arp§

  1. Read the manpage for arp, focusing on the Description section. What is it used for?
  2. Run arp -n to see the contents of the host's ARP cache. Copy this into your lab report.
  3. What is the range of IP addresses seen in the ARP cache? Pick an IP within that range that does not show up in the list, and use ping to ping that host. This will send one or more packets to that host, and of course it will need the host's MAC address to do so. Run arp -n again. Describe how running the ping command did or did not change the ARP cache, and explain why.
  4. Connect to www.ilstu.edu using the command links www.ilstu.edu. (Text-based web browsers FTW!) See if an entry appears in the arp cache. (It shouldn't.) Explain why no arp cache entry appeared.

Part D: ping§

  1. Read the manpage for ping, focusing on the Description section. What is it used for? Make sure you figure out 1) what type of information the program reports and 2) how you can control the ping "count" and packet size.

  2. Experiment with pinging each of the following hosts 20 times using the count option:

    1. www.iwu.edu   (on campus)
    2. hyperion.iwu.edu   (on campus)
    3. www.ilstu.edu   (across town)
    4. www.illinois.edu   (in Urbana)
    5. www.uchicago.edu   (in Chicago)
    6. www.cs.hmc.edu   (on the West Coast)
    7. www.cs.mit.edu   (on the East Coast)
    8. www.ucd.ie   (in Dublin, Ireland)
    9. mail.iwu.edu   (???)
    10. courses.iwu.edu   (???)
    11. What are the minimum, average, and maximum RTTs for each host?
    12. What are the reported TTLs on the echo_reply packets you received? What information, if any, can you deduce from these TTLs? (Hint: See man ping for information on the TTLs.)
    13. You probably didn't receive any replies from a few of the hosts. Are those hosts down (broken)?

  3. Ping hyperion.iwu.edu using packets of different sizes, from 30-byte packets to 1000-byte packets. Does the RTT vary with the size of the packet? What do you think accounts for the differences?

  4. Ping a host farther away using packets of different sizes, again from 30B to 1KB. Does the RTT vary with the size of the packet? What do you think accounts for the differences?

Part E: traceroute§

  1. Read the manpage for traceroute, focusing on the Description section and the last few paragraphs of the Options section. What is it used for, and how does it work?
  2. Use traceroute to determine the routes to the hosts listed in Part D above.
    1. What are the hop counts for each?
    2. What are the common hosts traversed by all paths taken to hosts outside IWU's network?
    3. Where the heck is courses.iwu.edu physically located, anyway? [hint: Cogent appears to name its networks/routers using airport codes.]
    4. How can traceroute find at least partial paths to some hosts that you couldn't ping?
    5. Why does traceroute not find paths to some hosts that you can ping?
  3. Public traceroute servers allow Internet users to learn about network routes from sources that are outside their own networks. The website www.traceroute.org is a directory of public traceroute servers. Using this website, find at least four geographically dispersed public traceroute servers and trace the route from each of them back to www.iwu.edu. (Personally, I think Kyrgyzstan is a good choice for one of them.)
    1. What would you guess is the average RTT between any two hosts on the Internet? The longest RTT? Explain your reasoning.
    2. What would you guess is the average number of hops between any two hosts on the Internet? The greatest number of hops? Explain your reasoning.

Part F: Pulling it All Together§

Describe in detail how you could use all of these utilities to explore and learn about an unknown network on which you had login access to a single Unix server. How would you use each one independently or in conjunction with others to probe the network, study its characteristics, learn about other hosts on the network, and so on? One way to approach this is to write a detailed procedure you could follow on any Unix host.

Extra credit (5pts): Create a single-node Emulab experiment (I suggest you use Fedora Core 10 for the OS), and use your ideas to learn everything you can about the network to which it is connected. Record your collected data in your lab report alongside your analysis.

Further Questions§

  1. Based on your experiments with ping and traceroute, what conclusions would you draw about the relationships between RTT, number of hops, and geographic distance? (Are there any relationships?)
  2. Did you discover anything else interesting while working on this lab?
  3. How long did you spend on this assignment? What problems, if any, did you run into?

Lab Report§

In general, write enough about each part so that I know what you did (e.g., what commands you ran), what you saw (e.g., the output of a particular command), and what you thought (answers to any questions and other analysis). Please do not copy everything into your lab report, however. I do not need to see each individual ping command, for example; one example is enough. And it would take a rare breed of passive-aggressive to copy every single line of ping output into the lab report; please don't do that. Use your common sense about what to include and what to simply describe or discuss, and please ask me if you're unsure about anything.