wiresharkICMP pingIP ICMP and Traceroute Wireshark CMD ping

在wireshark中觀察ICMP中 ping連線和IP協定

ICMP and Traceroute • • 啟動Wireshark軟體並開始抓取封包。 開始=>執行=>CMD 輸入”ping -n 10 www. ust. hk” 停止Wireshark，開始追蹤封包

ICMP and Traceroute 1. What is the IP address of your host? What is the IP address of the destination host? 2. Why is it that an ICMP packet does not have source and destination port numbers? 3. Examine of the ping request packets sent by your host. What are the ICMP type and code numbers? What other fields does this ICMP packet have? How many bytes are the checksum, sequence number and identifier fields? 4. Examine the corresponding ping reply packet. What are the ICMP type and code numbers? What other fields does this ICMP packet have? How many bytes are the checksum, sequence number and identifier fields?

IP • 啟動Wireshark軟體並開始抓取封包。 • 啟動Ping. Plotter軟體 • ”Address to Trace”中輸入 ” gaia. cs. umass. edu” • ”# of time to trace”中輸入” 3” • “Trace Interval”中輸入” 1 seconds” • “Samples to include”中輸入“ 11”

IP • • • Edit=>Option=>Packet Packer size(in bytes): 改為 56=>OK 按下”Trace” 直到按鈕變成Resume 再將Packer size(in bytes): 改為 2000=>OK 按下” Resume” 再將Packer size(in bytes): 改為 3500=>OK 按下” Resume” 停止Wireshark，開始追蹤封包

IP Select the first ICMP Echo Request message sent by your computer, and expand the Internet Protocol part of the packet in the packet details window. 5. What is the IP address of your computer? 6. Within the IP packet header, what is the value in the upper layer protocol field? 7. How many bytes are in the IP header? How many bytes are in the payload of the IP datagram? Explain how you determined the number of payload bytes.

IP 8. Has this IP datagram been fragmented? Explain how you determined whether or not the datagram has been fragmented. 9. Which fields in the IP datagram always change from one datagram to the next within this series of ICMP messages sent by your computer? 10. Which fields stay constant? Which of the fields must stay constant? Which fields must change? Why? 11. Describe the pattern you see in the values in the Identification field of the IP datagram

IP • Next (with the packets still sorted by source address) find the series of ICMP TTLexceeded replies sent to your computer by the nearest (first hop) router. 12. What is the value in the Identification field and the TTL field?

IP • Find the first ICMP Echo Request message that was sent by your computer after you changed the Packet Size in pingplotter to be 2000. 13. Has that message been fragmented across more than one IP datagram? 14. Print out the first fragment of the fragmented IP datagram. What information in the IP header indicates that the datagram been fragmented? What information in the IP header indicates whether this is the first fragment versus a latter fragment? How long is this IP datagram?

IP 15. Print out the second fragment of the fragmented IP datagram. What information in the IP header indicates that this is not the first datagram fragment? Are the more fragments? How can you tell? 16. What fields change in the IP header between the first and second fragment?

IP • Now find the first ICMP Echo Request message that was sent by your computer after you changed the Packet Size in pingplotter to be 3500 17. How many fragments were created from the original datagram? 18. What fields change in the IP header among the fragments?