Contents
Article I. Introduction
Article II. Application Layer
Article III. Transport Layer
Article IV. IP/Network Layer
Article V. Link Layer
Article VI. Physical Layer
Article VII. Conclusion
Article VIII. Bibliography
, Introduction
During this report I was investigating the behaviour of the TCP/IP protocol stack when accessing x-
stream from a remote location such as my home. I used Wireshark to analyze the packet data and I
discussed in detail the background processes which occurred at each layer of the protocol stack.
During this examination I studied specific protocols and the changes which occurred to the packet
headers as the data passed through the network.
Application Layer
The application layer is the highest level of the protocol stack; this layer makes the communication
between the applications and the transport protocols. The application protocol used for the given
task was HTTP which is the specific protocol for web pages, on top of SSL/TSL, which then makes it
HTTPS; HTTPS was most likely selected for x-stream because it prevents security breaches by
encrypting the data flow between the client and server.
DNS also works on the application layer and was used when accessing x-stream, DNS queries were
sent out in order to resolve the web address https://x-stream.leedsmet.ac.uk/ into an IP address, a
standard query response was then returned and the client could then send a connection request to
the server. (Figure 1)
Figure 1
LLMNR queries were also sent to allow IPv4 to perform name resolutions for hosts on the same local
link. (Wikipedia, 2013)
Transport Layer
The NetBIOS Name Server was also used to send out 3 name queries with UDP on port 137, they
were broadcast packets which sent queries of type NB, but no response queries were returned.
In order to perform the DNS queries UDP was used on port 53, this ensures a quicker response from
the name server. Because I had previously cleared my cache before capturing the packets, the ‘non-
authoritative’ flag was not set. The DNS queries were of type A and did not contain any answers
Article I. Introduction
Article II. Application Layer
Article III. Transport Layer
Article IV. IP/Network Layer
Article V. Link Layer
Article VI. Physical Layer
Article VII. Conclusion
Article VIII. Bibliography
, Introduction
During this report I was investigating the behaviour of the TCP/IP protocol stack when accessing x-
stream from a remote location such as my home. I used Wireshark to analyze the packet data and I
discussed in detail the background processes which occurred at each layer of the protocol stack.
During this examination I studied specific protocols and the changes which occurred to the packet
headers as the data passed through the network.
Application Layer
The application layer is the highest level of the protocol stack; this layer makes the communication
between the applications and the transport protocols. The application protocol used for the given
task was HTTP which is the specific protocol for web pages, on top of SSL/TSL, which then makes it
HTTPS; HTTPS was most likely selected for x-stream because it prevents security breaches by
encrypting the data flow between the client and server.
DNS also works on the application layer and was used when accessing x-stream, DNS queries were
sent out in order to resolve the web address https://x-stream.leedsmet.ac.uk/ into an IP address, a
standard query response was then returned and the client could then send a connection request to
the server. (Figure 1)
Figure 1
LLMNR queries were also sent to allow IPv4 to perform name resolutions for hosts on the same local
link. (Wikipedia, 2013)
Transport Layer
The NetBIOS Name Server was also used to send out 3 name queries with UDP on port 137, they
were broadcast packets which sent queries of type NB, but no response queries were returned.
In order to perform the DNS queries UDP was used on port 53, this ensures a quicker response from
the name server. Because I had previously cleared my cache before capturing the packets, the ‘non-
authoritative’ flag was not set. The DNS queries were of type A and did not contain any answers
