TCP/IP Lab
Internet and Investigative Tools

LAB PROJECT MANUAL

Gary C. Kessler
 Champlain College
Center for Digital Investigation
(6/18/2007)

The exercises below are intended to reinforce the accompanying TCP/IP presentation.

You can download the programs below from the Internet using Google or from the following mirror site; all of these programs are free:

•	Base64 utility: http://digitalforensics.champlain.edu/download/base64.zip

•	BlackWidow: http://digitalforensics.champlain.edu/download/BlackWidow.exe

•	GFI LANguard Network Scanner: http://infosec.champlain.edu/download/lannetscan.exe

•	McAfee Visual Trace: http://digitalforensics.champlain.edu/download/McAfeeVisualTrace.exe

•	Spade: http://digitalforensics.champlain.edu/download/spade114.exe

•	SuperScan: http://infosec.champlain.edu/download/superscan.exe

•	WebSnake: http://www.websnake.com/

1. Post Office Protocol (POP). If you have a POP e-mail account, logon to your POP server using the following telnet command:

		telnet pop_server 110

When you get the banner message and prompt, type:

		USER your_pop_username

Next, enter the password:

		PASS password

At that point, you can examine e-mail messages in your mailbox. POP3 is described in RFC 1939 (http://www.rfc-editor.org/rfc/rfc1939.txt). Some useful POP commands to try are:

•	DELE msg - Delete message msg

•	LIST - List size of messages in the mailbox

•	QUIT - Exit the POP service

•	RETR msg - Retrieve message msg

•	TOP msg n - Display the first n lines of message msg

•	UIDL [msg] - List the unique identifier of all messages in the mailbox or of message msg

2. Simple Mail Transfer Protocol (SMTP). Using a script similar to the one in the course notes, telnet to port 25 of an SMTP server local to your current network and send yourself an e-mail message. Alternatively, send Gary a message at gary.kessler@champlain.edu.

What happens when you attempt this to a non-local SMTP server that does not allow mail forwarding (e.g., mail.sover.net or mail.champlain.edu)?

3. Traceroute. a) This exercise is best done between two parties on different networks. The user of Host A should traceroute to Host B and the user of Host B should traceroute to Host A. Compare the results. Packets should follow the same path although the hop names and IP addresses should be different. Why? Try various traceroute tools, such as the command line utility, Sam Spade, and Visual Trace.

b) As an experiment, go to http://cities.lk.net/trlist.html and select a traceroute site. Do a traceroute to your own IP address. Then, do another traceroute from your own computer back to the traceroute site. Compare the two routes.

4. Domain analysis. Select a Web site and use the various tools to learn the following. Use more than one tool on these questions; sometimes you get different results!

•	IP address

•	Does the site respond to pings?
•	Trace the route to the site
•	The owner of the IP address block (also, the technical and administrative contacts and billing contact, if possible...)
•	The server software for the site
•	The name and address of the mail server(s) for the site's domain
•	The names and addresses of the name servers for the site's domain
•	Collect the pages of the Web site

5. Web site analysis. Select a Web site and visit it with your browser. View the source HTML code using the browser's View Source option.

Now, visit the same site using the following telnet command:

		telnet web_server 80

When you get the banner message and prompt, type:

		GET / HTTP/1.0

and then hit the <ENTER> key twice. Compare the results to the View Source option.

Finally, visit the same Web site using the Sam Spade "safe browser" from either the Sam Spade Web site (http://www.samspade.org) or using the Sam Spade client software.

6. Finger. Try fingering a site on the Internet; a Web site or FTP will do fine. Use the finger command on a *nix box or the Sam Spade utility.

You can also finger a site using the following telnet command:

		telnet target 79

To finger the system, merely hit <ENTER> again.

To finger a user, type in the username and hit <ENTER> twice.

7. BASE64. Cut the text below into a file and then "decode" the file using the BASE64 utility. (Hint: After decoding, you will have to look at the beginning of the file for the file signature to determine the file type. The list at http://www.garykessler.net/library/file_sigs.html may be useful for this purpose. What kind of file is it?)

R0lGODlhGAAYAPcAAAAAAL8AAAC/AL+/AAAAv78AvwC/v8DAwMDcwKTI8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP/78KCgpICAgP8AAAD/AP//AAAA//8A/wD//////yH5BAAAAAAALAAAAAAYABgABwikAA8IHEiwoMGDCBMqXIgQgMOHECNCLAjg3z6LGC9qzPjPIUEAG0NmBGnR48CKIlF2LHnRpECSGx3GZOnygMqW+FCSrMgTwMd9EPHl1AiyKFCfJzsKXcpzZdOaRZcKNUr16EelUp867Yj05VGHU4GKpdrVJteHOTFqhRryYUuaVpO2vbmT60+OYlmujPsSr1+VbP2KJFpWomHDFA8rLsuwseODAQEAOw==