Save the capture as a file called learnnamel3capture

5. Save the capture as a file called learnname_L3_capture . This is important, if you need to return
to the original file after applying display filters.
6. Type in the Display filter text box ip.addr==142.204.140.90 . This will show the beginning of your
conversation with the matrix server. Your Wireshark window should look like the screen shot
below.
6. Notice the first conversation between your host to the server is a [SYN] packet with an info
number of 49912 (yours will be different). The latter is a TCP flag which tells the server to open a
connection to the host. Notice SEQ=0. Click on the [SYN] packet and open the drop-down arrow
on the Transmission Control Protocol in the Details pane in the middle Wireshark window.
7. In the top Wireshark packet list pane, select the second TCP packet, labeled SYN, ACK with the
same info number 49912.
8. Observe the packet details in the middle Wireshark packet details pane. Notice that it is an
Ethernet II / Internet Protocol Version 4 / Transmission Control Protocol frame.
9. Expand Ethernet II to view Ethernet details. Answer the following questions in the table below:
10. Observe the Destination and Source fields.
11. Expand Internet Protocol Version 4 to view IP details.
12. Observe the Source and Destination IP addresses.
13. Expand Transmission Control Protocol to view TCP details.
14. Observe the Source and Destination ports.
15. Observe the Sequence number. Notice that it is 0 (relative sequence number). To see the actual
sequence number, select Sequence number to highlight the sequence number in the bottom
Wireshark bytes pane.

Client
Server
SYN
SYN ACK
ACK
Lab 3 DCF255 P a g e | 3
16. Observe the Acknowledgement number. Notice that it is 1 (relative ack number). To see the
actual acknowledgement number, select Acknowledgement number to highlight the
acknowledgement number in the bottom pane. Notice that the actual acknowledgement
number is one greater than the sequence number in the previous segment.
17. Expand Flags to view flag details.
18. Observe the flag settings. Notice that SYN and ACK flags are set, indicating the second segment
in the TCP three-way handshake.
FIN ACK Packet Analysis
What is the source MAC address of this packet?
(should be the default gateway physical address)
ac 20 2e 05 71