. When running a scan on your computer, you find that a session has been established with a host at the address 208.85.40.44:80. Which Application layer protocol is in use for this session? What command-line utility might you use to determine which computer is the host?

Question

. When running a scan on your computer, you find that a session has been established with a host at the address 208.85.40.44:80. Which Application layer protocol is in use for this session? What command-line utility might you use to determine which computer is the host?

Answer 1

The Application layer protocol in use for this session is likely Hypertext Transfer Protocol (HTTP), as port 80 is the default port for HTTP communication.

To determine which computer is the host at the given IP address, you can use the command-line utility "nslookup" (or "dig" in some cases) to perform a reverse DNS lookup.

For example, you can use the following command in the command prompt or terminal:

```
nslookup 208.85.40.44
```

This will provide you with the hostname associated with that IP address, giving you information about the host computer.

Answer 2

To determine the application layer protocol in use for a session established with a host at the address 208.85.40.44:80, you can take the following steps:

Step 1: Identify the commonly used protocols for web browsing. The most common protocol for web browsing is HTTP (Hypertext Transfer Protocol), which usually runs on port 80.

Step 2: Verify if the session is using the HTTP protocol. You can use the command-line utility "netstat" (network statistics) to check the active network connections and their associated processes. On most operating systems, you can open a command prompt or terminal and enter the following command:

```
netstat -aon | findstr "208.85.40.44:80"
```

This command will display any active network connections involving the specified IP address (208.85.40.44) and port (80). The "-a" option shows all connections and listening ports, "-o" shows the associated process ID, and "findstr" filters the output to only display the specified IP address and port.

Step 3: After executing the command, the output will provide information about the process ID (PID) associated with the connection. You can then use the Task Manager (Windows) or the "ps" command (Linux/macOS) to determine which computer or program is the host for that connection.

For Windows, follow these steps:
1. Press Ctrl+Shift+Esc to open the Task Manager.
2. Go to the "Processes" or "Details" tab (depending on the Windows version).
3. Look for the process ID (PID) obtained from the previous netstat command. You may need to add the "PID" column to the Task Manager's display.
4. Identify the process corresponding to the PID to determine the program or service that is hosting the connection.

For Linux/macOS, follow these steps:
1. Open a terminal window.
2. Enter the following command:

```
ps -p <PID>
```

Replace <PID> with the process ID obtained from the netstat command.
3. The output will provide information about the program or process associated with the specified PID, helping you identify which computer or program is hosting the connection.

Using these steps, you can determine the application layer protocol and the computer or program hosting the session with the given IP address and port number.