Analysis of the encapsulated traffic

Appendix A

REQUIREMENTS TO THE PROTOCOL CONTENT

7.6.1 The name of laboratory work.

7.6.2 Purpose of the work.

7.6.3 Results of home assignments.

7.6.4 Short description of the work done.

7.6.5 Conclusions about the work done.

7.6.6 Date, the signature of a student, the remark of a teacher.

In the trace of Frame Relay messages and encapsulated traffic of higher levels protocols two approaches got spread in forming of the route. The first approach assumes the presence of a specialist working with the route, complete knowledge about the structure of the protocol, structure of all elements of information, etc. In this case, tracing protocol is executed up to bit. Usually, the values ​​of bits are represented in a form suitable not only for the analysis, but for the location in the information field. This approach provides routes with a maximum detailisation. These routes can be successfully used both in the development of data transmission equipment, and at the operational dimensions. Negative factor here is the need for deep knowledge about the structure of the protocol for operating personnel and a large redundancy of information in the route, which often makes it difficult to understand. As an example, such routes will be presented below by Sniffer Expert protocol analyzer developed by Company Network General Corp.

The second approach focuses on the making of operational measurements. Routes that are generated in this case, reflect only the most essential messages and information elements for signal exchange. As a result, information redundancy, which occurs in the first approach, is reduced. In addition, the requirements for speed of analyzers is decreased and, consequently, their cost. As a negative factor here is the inability to use such analyzers for measuring during the development of data transmission equipment, as well as in the case of incorrect implementation of the protocol (route identifies the incorrect implementation of the protocol, but does not specify exactly, which bits are incorrect values; in practice such cases aren’t usually met). As an example such operational routes will be presented below the route analyzer ParaScope2000 produced by Frederick Engineering Inc.

As an example of the analysis of the encapsulated traffic, let’s consider the analysis of a hypothetical data network linking two or more local area networks (Figure 1).

Figure 1 -Scheme of high-levels protocol encapsulations (NetWare)

At combining of local networks, measuring physical channel can include virtual connections, which transmit the encapsulated information of the various protocols (in general, in the PD networks there are used about 100... 150 or more of different protocols and modifications). As a result, multi-protocol exchange, route of the Frame Relay protocol will contain encapsulated message of various protocols (route 1).

Route 1 An example of simple route of multi-protocol-traffic in the Frame Relay network (Sniffer Expert analyzer)

Summary	Delta Т	Destination	Source	Summary
		44135046.FFFF	44135046.Wllf	XNS RIP response: 10 networks, 20850301 at 2 hops, 20850302 at 2 hops
	0.1982	BOOMER1	9943AC.3Com	NCPC Create Connection
	0.0624	9943AC.3Com	BOOMER1	NCPROK
	0.3588			SNAP Ethernet Type=80FF
	0.0732	BRUTUS1	9943AC.3Com	NCPC Create Connection
	0.0917	9943AC.3Com	BRUTUS1	NCPROK
	1.0991			SNAP Ethernet Type=80FF
	0.1960			SNAP Ethernet Type=80FF
	0.1039	BUSTER1	9943AC.3Com	NCPC Create Connection
	0.0788	9943AC.3Com	BUSTER1	NCPROK
	0.1228			SNAP Ethernet Type=80FF
	0.3411	BOOMER1	9943AC.3Com	NCPC Create Connection
	0.0639	9943AC.3Com	BOOMERl	NCPROK
	0.1651			SNAP Ethernet Type=80FF
	0.1342			SNAP Ethernet Type=80FF
	0.1297	BRUTUS1	9943AC.3Com	NCPC Create Connection
	0.0867	9943AC.3Com	BRUTUS1	NCPROK
	0.3134			SNAP Ethernet Type=80FF
	0.2690	000000225D02		SNAP Ethernet Type=80FF
	0.1020			SNAP Ethernet Type=80FF
	0.7196	BUSTERl	9943AC.3Com	NCPC Create Connection
	0.0780	9943AC.3Com	BUSTER1	NCPROK
	0.0950			SNAP Ethernet Type=80FF
	0.2452	(X. Y. 1.255]	[X.Y. 1.2]	RIP R Routing entries=10
	0.1244	BOOMERl	9943AC.3Com	NCPC Create Connection
	0.0654	9943AC.3Com	BOOMERl	NCPROK
	0.3716	[X.Y.1.255]	[X.Y.1.2]	RIP R Routing entries=10
	0.0559	BRUTUS1	9943AC.3Com	NCPC Create Connection
	0.0919	9943AC.3Com	BRUTUS1	NCPROK
	0.2400			SNAP Ethernet Type=80FF
	0.3212			SNAP Ethernet Type=8OFF
	0.2201			SNAP Ethernet Type=80FF
	0.6175	BUSTER1	9943AC.3Com	NCPC Create Connection
	0.0791	9943AC.3Com	BUSTERl	NCPROK
	0.4636	BOOMERl	9943АС. 3Com	NCP С Create Connection
	0.0623	9943AC.3Com	BOOMERl	NCPROK
	0.0395			SNAP Ethernet Type=80FF
	0.2718	44135044.FFFF	44135046.Wllf	XNS RIP response: 12 networks, 00210101 at 2 hops, 00210102 at 2 hops
	0.1194	BRUTUS1	9943AC.3Com	NCPC Create Connection
	0.0870	9943AC.3Com	BRUTUS1	NCP R OK
	0.2379	NFIDC08	4.1	XNS NetWare Security
	0.1271	701B.00608CB8	7107F2.1	NDIAG IPX Config request
	0.3489			SNAP Ethernet Type=80FF
	0.2054	DCE.DLCI.O	DTE.DLCI.O	LMI Keep Alive Status Enquiry
	0.0086	DTE.DLCI.O	DCE.DLCI.O	LMI Keep Alive Status
	0.1015			SNAP Ethernet Type=80FF
	0.2326			SNAP Ethernet Type=80FF
	0.1418	BUSTERl	9943AC.3Com	NCPC Create Connection
	0.0782	9943AC.3Com	BUSTERl	NCPROK
	0.4645	BOOMERl	9943AC.3Com	NCPC Create Connection

As can be seen from the route, among messages, which are sent through the point of measurement, there are a variety of high-level protocols, including routing protocol RIP (Routing Information Protocol), which is used for Xerox Network Systems (XNS) network, the main NetWare networks protocol (NCP - NetWare Core Protocol), the diagnostics protocol of NetWare networks (NDIAG), the RIP protocol, which is used for exchanging in TCP / IP protocol, the SNAP protocol, which is used to encapsulate data traffic from the LAN. In addition, the route contains control information LMI (posts 44, 45), which was seen in the lab number 5. It should be noted that in order to preserve the confidentiality of the IP, address in the route is replaced by X and Y.

Дата добавления: 2014-12-27