NAD710 Lab 2

Objectives

1. Use the ifconfig and/or ip command(s) to display/assign IP paramenters to a network device
2. Use the ifconfig command to disable/enable ARP on a network interface
3. Use the arp command to display the system ARP cache
4. Use the arp command to add manual entries to the system ARP cache
5. Use the tcpdump command to capture and display network packets

Background Information

On a TCP/IP Ethernet network, every application data packet contains 3 pairs of numbers: source and destination physical addresses (or MAC addresses ), source and destination IP addresses, and source and destination ports. The first two pairs of numbers are the main focuse of this lab.

Software Requirements

Linux Distributions:

• Fedora Core 8/9

RPM Packages:

• ethtool
• iproute
• net-tools
• tcpdump

Hardware requirements

Two Linux Machines on a Ethernet LAN

Lab with the proper hardware and software: T2107 in TEL building.

Procedure

You need two Linux systems connected to a LAN. Make sure that each system has only ONE network interface card. Label one system as Host-A and the other system as Host-B.

• Boot up both system to Fedora Core 8 or 9.
• Login to Host-A and Host-B under a regular user account. Don't login as "root".
• On Host-A, open up two terminal windows, set the title on one terminal windows to "T" and the other to "C". "T" for tcpdump window and "C" for command window.
• Do the same on Host-B as on Host-A.
• Switch to user "root" on all four terminal windows.
• Use the command "ifconfig" to find out the name (ethxx), IP address, broadcast address, netmask and the MAC address of the network device on Host-A and Host-B. Keep this information for later use.
• Use the command "ip addr" on Host-A and Host-B and keep the output for later use.
• Use the "ping" command to check the network connection between Host-A and Host-B. Ask for help if Host-A can not talk to Host-B.
• Commands in the following steps may contain the variable x. If you are doing this lab using your own LAN, you can pick any value between 1 and 254 for x. If you are working in the LUX lab, make sure you are not using the same x value as any other students in the Lab.
• On terminal window "C" on Host-A, set the IP address for the network device to 172.16.x.1, netmask to 255.255.255.0, and set the broadcast address to the appropriate value.
• On terminal window "C" on Host-B, set the IP address for the network device to 172.16.x.2, netmask to 255.255.255.0, and set the broadcast address to the appropriate value.
• Use the "ifconfig" or "ip addr" on Host-A and Host-B to verify the newly assigned addresses. Make changes if necessary. Ask for help if you have any troubles.
• Use the "ping" command to verify the network connection between Host-A and Host-B for the new addresses. Go on to the next step only after a positive result.
• On terminal window "C" on Host-A, enter the following commands and keep the outputs for later use:

    arp -n
    ifconfig ethxx down
    arp -n
    ifconfig ethxx up
    arp -n

• Do the same on Host-B.
• On terminal window "T" on Host-A, enter the following command and keep the output for later use:

    tcpdump -n arp host 172.16.x.1

• On terminal window "T" on Host-B, enter the following command and keep the output for later use:

    tcpdump -n arp host 172.16.x.2

• On terminal window "C" on Host-A, enter the following "ping" command and watch the outputs on terminal "T" on Host-A and Host-B.
• Do the same on Host-B.
• On terminal window "C" on Host-A, enter the command "arp -n", record the MAC address of Host-B and label it as MAC-B.
• On terminal window "C" on Host-B, enter the command "arp -n", record the MAC address of Host-A and label it as MAC-A.
• On terminal window "C" on Host-B only, enter the following commands and compare the outputs of the first and last "ifconfig" command and spot the difference(s).

       ifconfig ethxx 
       ifconfig ethxx down
       ifconfig ethxx -arp
       ifconfig ethxx up
       ifconfig ethxx

• On terminal window "T" on Host-B, terminate the "tcpdump" and retype the last tcpdump command.
• On terminal window "C" on Host-A, send two ping packets to Host-B and watch the outputs to Host-A and Host-B's terminal window "T"s. Record your observation for later use.
• On terminal window "C" on Host-A only, enter the following commands and record the output for later reference:

       arp -s 172.16.x.2 MAC-B (put Host-B's MAC here)
       arp -n

• On terminal window "C" on Host-A, send two ping packets to Host-B and record your observation.
• On terminal window "C" on Host-B, enter the following commands and record the output:

       arp -s 172.16.x.1 MAC-A (put Host-A's MAC here)
       arp -n

• On terminal window "C" on Host-A, send two ping packets to Host-B and record your observation.
• On terminal window "C" on Host-B, enter the following commands and record your observation:

       ifconfig ethxx down
       ifconfig ethxx arp
       ifconfig ethxx 
       arp -n

• Make sure that the tcpdump command is still running on terminal window "T" on Host-B.
• Send two ping packets from Host-B to Host-A, wait for 30 seconds and send another two ping packets to Host-A. Compares the two sets of packets captured and record your observation.

Exercise

When Host-A pings Host-B the very first time, Host-A sends an ethernet broadcast to find out which network device owns the target IP address. The network device that has a matching IP address will response with its MAC address. Once the MAC address was found, Host-A will keep the MAC address and the corresponding IP address in its system ARP cache table for a short period (a few minutes) of time and then the information will be discarded. Use Host-A and Host-B to determine the life time of an ARP reply entry on your Linux system correct to the nearest minute.

Questions

Based on your observation of the outputs from the commands issued during the lab, prepare the answers for the following questions:

1. What is the effect of the first "ifconfig ethxx down" command on the system's ARP cache?
2. What command disable ARP on a network interface?
3. How do you enable ARP on a network interface if it has been disabled?
4. What is the consequence of disabling ARP on a network interface?
5. How do you manually add an entry to the ARP cache?
6. What would be the possible advantage of disabling ARP on a network interface?
7. Describe the procedure you used in determining the life time of an ARP cache entry on a Linux system.

Completing this Lab

Post your answers for this lab to NAD710 Lab 2 Answers