An IP machine Q has a path to another IP machine H via three IP routers R1, R2, and R3. Q—R1—R2—R3—H H acts as an HTTP server, and Q connects to H via HTTP and downloads a file. Session layer encryption is used, with DES as the shared key encryption protocol. Consider the following four pieces of information: [I1] The URL of the file downloaded by Q [I2] The TCP port numbers at Q and H [I3] The IP addresses of Q and H [I4] The link layer addresses of Q and H Which of I1, I2, I3, and I4 can an intruder learn through sniffing at R2 alone?

Let us analyze each piece of information visible at router R2 during packet forwarding:

• [I1] URL of the downloaded file: The URL is part of the application-layer HTTP request. Since session layer encryption is used, the payload containing the HTTP header and URL is encrypted using DES. Therefore, an intruder sniffing packets at R2 cannot read the URL.

• [I2] TCP port numbers at Q and H: Encryption happens at the session layer, above the transport layer. The TCP headers remain unencrypted, so the source and destination TCP port numbers are fully visible at R2.

• [I3] IP addresses of Q and H: Network-layer IP headers are also unencrypted because routers need them for packet routing. The source and destination IP addresses are preserved end-to-end and can be observed at R2.

• [I4] Link layer (MAC) addresses of Q and H: Data link layer addresses are hop-by-hop (local to the specific link). The frames arriving at R2 contain the MAC address of R1, and frames leaving R2 contain the MAC address of R3. The MAC addresses of the end hosts Q and H are never transmitted to R2.

Therefore, the intruder at R2 can only learn I2 and I3, making (C) the correct option.