GATE CS 2014 Set 2 Q27 — Routing Protocols: Shortest Path, Flooding, Distance Vector, Link State

To determine which information can be learned by sniffing packets at router $R2$, we analyze the network layers and where the encryption is applied.

1. Impact of Session Layer Encryption

Encryption is applied at the Session layer. This means all data from the Session layer and layers above it (such as the Application layer) is encrypted, while headers of the layers below it (Transport, Network, and Data Link layers) are transmitted in plaintext.

• [I1] URL of the file: The URL is part of the HTTP request, which belongs to the Application layer. Since the Application layer is above the Session layer, this information is encrypted. The intruder cannot learn $I1$.
• [I2] TCP port numbers: TCP ports belong to the Transport layer, which lies below the Session layer. Therefore, the TCP header is transmitted in plaintext. The intruder can learn $I2$.
• [I3] IP addresses of $Q$ and $H$: IP addresses belong to the Network layer, which lies below the Session layer. These addresses remain unchanged end-to-end in the IP header. The intruder can learn $I3$.

2. Link Layer Addresses

• [I4] Link layer addresses of $Q$ and $H$: Link layer (MAC) addresses are hop-by-hop and change at every router. When sniffing at $R2$, the intruder will only see the link-layer addresses of the adjacent hops (i.e., between $R1$ and $R2$, or $R2$ and $R3$). The original link-layer addresses of $Q$ and $H$ are stripped off at the first router and are not present in the frames passing through $R2$. The intruder cannot learn $I4$.

Thus, the intruder can only learn $I2$ and $I3$.

Correct Option: C