这部分回顾Wireshark Lab5，该实验主要目标是了解UDP协议。

参考资料：

Wireshark Lab5: UDP

1

User Datagram Protocol, Src Port: 161, Dst Port: 4334
    Source Port: 161
    Destination Port: 4334
    Length: 59
    Checksum: 0x53f2 [unverified]
    [Checksum Status: Unverified]
    [Stream index: 1]
    [Timestamps]
    UDP payload (51 bytes)

所以一共5个字段，注意中括号的部分不是字段。

2

Source Port，Destination Port，Length，Checksum都是2字节，UDP payload字节数量为Length - 8。

3

长度字段指报文长度，考虑如下报文

User Datagram Protocol, Src Port: 161, Dst Port: 4334
    Source Port: 161
    Destination Port: 4334
    Length: 59
    Checksum: 0x53f2 [unverified]
    [Checksum Status: Unverified]
    [Stream index: 1]
    [Timestamps]
    UDP payload (51 bytes)

报文长度为

和Length对应。

4

2字节的数字最大值为

所以有效负载中的最大字节数为

5

最大的源端口号为

6

Internet Protocol Version 4, Src: 192.168.1.104, Dst: 192.168.1.102
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
    Total Length: 79
    Identification: 0xeda2 (60834)
    Flags: 0x00
    Fragment Offset: 0
    Time to Live: 60
    Protocol: UDP (17)
    Header Checksum: 0x0cdd [validation disabled]
    [Header checksum status: Unverified]
    Source Address: 192.168.1.104
    Destination Address: 192.168.1.102

所以协议号为：

UDP (17)

7

考虑编号为2,11的报文：

2	0.016960	192.168.1.104	192.168.1.102	SNMP	93	get-response 1.3.6.1.4.1.11.2.3.9.4.2.1.2.2.2.1.0

11	3.016971	192.168.1.102	192.168.1.104	SNMP	92	get-request 1.3.6.1.4.1.11.2.3.9.4.2.1.2.2.2.1.0

端口号：

User Datagram Protocol, Src Port: 161, Dst Port: 4334
    Source Port: 161
    Destination Port: 4334
    Length: 59
    Checksum: 0x53f2 [unverified]
    [Checksum Status: Unverified]
    [Stream index: 1]
    [Timestamps]
    UDP payload (51 bytes)

User Datagram Protocol, Src Port: 4336, Dst Port: 161
    Source Port: 4336
    Destination Port: 161
    Length: 58
    Checksum: 0x64f6 [unverified]
    [Checksum Status: Unverified]
    [Stream index: 3]
    [Timestamps]
    UDP payload (50 bytes)