Unlock document.
This document is partially blurred.
Unlock all pages and 1 million more documents.
Get Access
Wireshark Lab: IP
SOLUTION
Supplement)to)Computer)Networking:)A)Top3Down)
Approach,)6th)ed.,)J.F.)Kurose)and)K.W.)Ross)
)
©)2005921012,)J.F)Kurose)and)K.W.)Ross,)All)Rights)Reserved)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
Fig. 1 ICMP Echo Request message IP information
1. What is the IP address of your computer?
)
2. Within the IP packet header, what is the value in the upper layer protocol field?
)
3. How many bytes are in the IP header? How many bytes are in the payload of the
IP datagram? Explain how you determined the number of
4. Has this IP datagram been fragmented? Explain how you determined whether or not
)
5. Which fields in the IP datagram always change from one datagram to the next
within this series of ICMP messages sent by your computer?
)
6. Which fields stay constant? Which of the fields must stay constant? Which fields
must change? Why?
The fields that stay constant across the IP datagrams are:
•
Version (since we are using IPv4 for all packets)
•
header length (since these are ICMP packets)
•
source IP (since we are sending from the same source)
)
The fields that must stay constant are:
•
Version (since we are using IPv4 for all packets)
•
header length (since these are ICMP packets)
)
The fields that must change are:
•
Identification(IP packets must have different ids)
)
7. Describe the pattern you see in the values in the Identification field of the IP
datagram
Fig. 2 ICMP TTL exceeded reply, IP information
)
8. What is the value in the Identification field and the TTL field?
)
9. Do these values remain unchanged for all of the ICMP TTL-exceeded replies sent
to your computer by the nearest (first hop) router? Why?
The identification field changes for all the ICMP TTL-exceeded replies
because the identification field is a unique value. When two or more IP
Fig. 3 ICMP Echo Request pkt size = 2000, first fragment
)
10. Find the first ICMP Echo Request message that was sent by your computer after
you changed the Packet Size in pingplotter to be 2000. Has that message been
fragmented across more than one IP datagram?
)
11. Print out the first fragment of the fragmented IP datagram. What information in
the IP header indicates that the datagram been fragmented? What information in
the IP header indicates whether this is the first fragment versus a latter fragment?
How long is this IP datagram?
)
12. Print out the second fragment of the fragmented IP datagram. What information in
the IP header indicates that this is not the first datagram fragment? Are the more
fragments? How can you tell?
)
13. What fields change in the IP header between the first and second fragment?
Fig. 5 ICMP Echo Request pkt size = 3500, first fragment
)
14. How many fragments were created from the original datagram?
)
15. What fields change in the IP header among the fragments?
