Advanced Communication Networks

Lab - 09

Iqbal Uddin Khan

Lab 09 IP
Q1 - Select the first ICMP Echo Request message sent by your computer, and expand the Internet Protocol part of the packet in the packet details window. What is the IP address of your computer? Ans: Selecting the first ICMP echo ping packet (), my IP address is 192.168.0.105 (Source).

Q2 - Within the IP packet header, what is the value in the upper layer protocol field? Ans: Protocol: ICMP (1). Q3 - How many bytes are in the IP header? How many bytes are in the payload of the IP datagram? Explain how you determined the number of payload bytes. Ans: 20 Bytes in header, Pay load bytes = Header Bytes Total Bytes, so 46 Bytes = 20 Bytes 56 Bytes. Q4 - Has this IP datagram been fragmented? Explain how you determined whether or not the datagram has been fragmented. Ans: Not fragmented. Packets flag details are below.
Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Page 1

Advanced Communication Networks

Lab - 09

Iqbal Uddin Khan

Q5 Which fields in the IP datagram always change from one datagram to the next within this series of ICMP messages sent by your computer? Ans: There are three fields which I observed, they are below: 1. Identification (in differentiated services field). 2. Time to Live. 3. Header Checksum. Q6 - Which fields stay constant? Which of the fields must stay constant? Which fields must change? Why? Ans: Fields which stay constant are below: 1. 2. 3. 4. 5. Source IP. Destination IP. IP version, i.e. 4. Header Length i.e. 20 Bytes Total Length i.e. 56 Bytes.

Fields which are mentioned above must stay constant as they vary according to source. And the fields which are varying they do vary packet to packet. Q7 - Describe the pattern you see in the values in the Identification field of the IP datagram. Ans: I observed the increment (or decrement) of 1, in Identification (in differentiated services field) and TTL. Q8 - What is the value in the Identification field and the TTL field? Ans: TTL value in my captured traces starts from 1 (Frame/Packet 19) to 35 (Frame/Packet 598), TTL exceeded packet eliminated. Identification field has various values. Q9 Do these values remain unchanged for all of the ICMP TTL-exceeded replies sent to your computer by the nearest (first hop) router? Why? Ans: The TTL and Identification (in differentiated services field), do vary in first hop (192.168.1.1), after that TTL do vat but Identification (in differentiated services field) become 0x0000. Q10 - Find the first ICMP Echo Request message that was sent by your computer after you changed the Packet Size in ping-plotter to be 2000. Has that message been fragmented across more than one IP datagram? Ans: it is fragmented in two as mentioned in details of from 307, below are details:
2 IPv4 Fragments (1980 bytes): #306(1480), #307(500)

Q11 - Print out the first fragment of the fragmented IP datagram. What information in the IP header indicates that the datagram been fragmented? What information in the IP header indicates whether this is the first fragment versus a latter fragment?
Page 2

Advanced Communication Networks

Lab - 09

Iqbal Uddin Khan

Ans: The information present in the first packet of IPv4 (Frame 309) of fragmentation indicated that it is fragmented and it is of 1500 Bytes. Below are the details of packet:
Total Length: 1500 Identification: 0x3df5 (15861) Flags: 0x01 (More Fragments) 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..1. .... = More fragments: Set

Q12 - Print out the second fragment of the fragmented IP datagram. What information in the IP header indicates that this is not the first datagram fragment? Are the more fragments? How can you tell? Ans: The information present in the first packet of ICMP (Frame 310), indicated that there are no more fragments. Details are below:
Total Length: 520 Identification: Flags: 0x00 0... .... = .0.. .... = ..0. .... = 0x3df5 (15861) Reserved bit: Not set Don't fragment: Not set More fragments: Not set

Q13 - What fields change in the IP header between the first and second fragment? Ans: The three fields were changed between frame 309 and 310, listed below:

S.No 1 2 3

Field Name Fragment Offset Total Length Header Checksum

Packet 309 0 1500 0 x 1e97

Packet 310 1480 520 0 x 41b2

Q14 - How many fragments were created from the original datagram? Ans: Three fragments were created as mentioned in (Frame 463) IP header, mentioned below:
3 IPv4 Fragments (3480 bytes): #461(1480), #462(1480), #463(520)

Q15 - What fields change in the IP header among the fragments? Ans: The three fields were changed among frame 461, 462 and 463, listed on next page:

S.No 1 2 3

Field Name Fragment Offset Total Length Header Checksum

Packet 461 0 1500 0 x 1f76

Page 3

Packet 462 1480 1500 0 x 1ebd

Packet 463 2960 540 0 x 41c4