Question

Johnny just set up a TCP connection with a web server in Chicago, Illinois, claiming he is coming in with a source IP address that clearly belongs to a network in Copenhagen, Denmark. In exam- ining the session logs, you notice that he was able to complete the three-way handshake for this connection in 10 milliseconds. How can you use this information to prove Johnny is lying?

Answer 1

Assuming that the distance from Chicago Illinois to Copenhagen Denmark is 4200 miles and the speed of light is 186,400 miles per second;

The time difference 10 milliseconds in the session log and the calculated time of 22.5 milliseconds.

Step-by-step explanation:

The TCP three way handshake connection time is determined by the distance between the connecting hosts and the speed of the link.

If the distance between the hosts is 4200 miles and the link speed is an assumed speed of light 186,400 miles per second, the TCP session time is;

Time = distance/ speed

Time = 4200 / 186400

Time = 0.0225 seconds. = 22.5 milliseconds

But Johnny's TCP session time is 10 milliseconds, therefore Johnny is lying about the source IP address from Copenhagen Denmark.