NETW250 Week 3 iLab: Observing VoIP Protocols Using Wireshark

Your Name:

Professor’s Name:

Date:

Task 2: Filter and Examine RTP Packets

6.     In the Tree View section (i.e., the middle section), click on the plus box next to the Real-Time Transport Protocol header and expand it.

·       What’s the value of the Payload type field? _____

·       What’s the value of the Sequence number field? _____

·       What’s the value of the Timestamp field? _____

7.     Go back to the Packet List Section and select the next RTP packet. In the Tree View section, click on the plus box next to the Real-Time Transport Protocol header and expand it.

·       What’s the value of the Payload type field? _____

·       What’s the value of the Sequence number field? _____ (Hint: this number should be one up the previous sequence numbers; otherwise, you chose the wrong packet.)

·       What’s the value of the Timestamp field? _____

·       Subtract the timestamp value from Step 6 from the timestamp value here to determine the unit of time contained in each packet. _____

·       The captured call in this iLab uses the default G.711 codec, which generates 8,000 samples every second. Typically, the RTP timestamp clock rate is the same as the sampling rate. Therefore, the RTP timestamp clock increments once for each byte or sample.

·       If each increment of the RTP timestamp clock (i.e., one unit) represents 1/8,000 of a second, how many milliseconds of conversation are carried in each RTP packet? _____

·       Given the payload bit rate of G.711 codec as 8,000 bits per second, the payload size in milliseconds calculated above can also be represented in _____ bits or _____ bytes.

8.     Go back to the Packet List Section and highlight any RTP packet. In the Tree View section, minimize all headers by clicking on all minus boxes.

·       What’s the protocol header shown on top of Real-time Transport Protocol? _____

·       What’s the next protocol header shown above that? _____

9.     In the same Tree View section, click on the plus box next to the Internet Protocol Version 4 header and expand it.

·       What’s the value (in bytes) of the Header length field? _____

·       What’s the value (in bytes) of the Total length field? _____

·      Subtract from the total length: 20 bytes for IP header, 8 bits for UDP header, and 12 bytes for RTP header. What’s the payload length in bytes? _____

·      Does the payload length in bytes match the payload size in bytes in Step 6? _____

Task 3: Filter and Examine RTCP Packets

5.     In the Tree View section below, click on the plus box next to the Real-rime Transport Control Protocol (Sender Report) header and expand it.

·       What’s the RTP time stamp? _____

·       What’s the NTP time stamp? _____. The NTP time stamp is the wall clock time when this Sender Report packet was sent.

·       What’s the value of the Sender’s packet count field? _____. This is the number of packets sent since starting transmission, up until the time this Sender Report packet was generated.

6.     Click on plus boxes to expand the Source 1 header and SSRC contents.

·       What’s the value of the Fraction Lost field? _____

·       What’s the value of the Interarrival jitter field? _____

·       Each unit of the interarrival jitter value typically approximates 1/400 of a millisecond. If the value of the interarrival jitter here is 1 (unit), what’s the interarrival jitter in milliseconds? _____

7.     Click through the rest of the RTCP Sender Report packet.

·       Does the packet loss ratio change? _____

·       Does the interarrival jitter value change? _____

·       Based on its codec, loss ratio, and interarrival jitter value, where did this captured call most likely occur: on a private LAN or a public WAN? _____

Task 4: Filter and Examine SIP Messages

5.     In the Tree View section, expand the Session Initiation Protocol header and then Message Header to locate the following information. (Hint: To copy the value of a field directly from Wireshark, right-click on a field, choose Copy, and then choose Value. Right-click in this document and paste the clipboard content here.)

·       Request line: _____

·       Via: _____ Max-Forwards: _____

·       From: _____ tag = _____

·       To: _____

·       Call-ID: _____

·       Allow: _____

·       Content-Type: _____

7. Compare IP addresses in Step 6 to addresses in the From:, To:, and Via: fields in Step 5. What is the role

 of the VoIP server in delivering this INVITE message? _____

8.     The Max-Forwards field of the INVITE message contains an integer value that limits the number of hops a request can make on its way to the destination proxy server. Its value decreases by 1 at each hop.

Remember that the time to live (TTL) value of an IP packet limits the number of hops an IP packet can make on its way to the destination router. Here, what does a hop in the Max-Forwards field refer to? _____

9.     In the same Tree View section, minimize Message Header by clicking on the minus box next to it. Click on the plus box next to Message Body and then click on the plus box next to the Session Description Protocol header.

The SDP message contains a proposed description of the session. You should see several Media Attribute values listed in the SDP header. Record the audio codec values from Media Attribute fields here. _____

If you are not sure about the correct answer, locate the Media Description field above and you should see the same list of audio codecs specified there (their names could be slightly different).

10.   SIP response messages start with a status line instead of a request line as the INVITE method message does. A status line consists of the protocol version, a numeric status code, and its corresponding textual phrase. The code and phrase indicate the outcome of an attempt to serve a request.

In the Packet List section, locate and highlight the 100 Trying message by looking in the Info column. The 100 Trying message indicates that the request has been received by the next-hop proxy or VoIP server and unspecified actions are taking place (i.e., “Hey, wait here until I have more to tell you”).

In the Tree View section, expand Message Header and record the following information.

·       Status line: _____

·       Via: _____

·       To: _____

·       From: _____ tag = _____

·       Call-ID: _____

11.   In the Packet List Section, locate and highlight the 180 Ringing message by looking in the Info column. The 180 Ringing message is used to generate an alerting message.

In the Tree View section, expand Message Header and record the following information.

·       Status line: _____

·       Via: _____

·       To: _____ tag = _____

·       From: _____ tag = _____

·       Call-ID: _____