Scribd
Upload
55 views4 pages

W W W .Goog L E.co. I N

The document discusses using Wireshark to capture ICMP packets from pinging google.co.in and using traceroute to trace the route to google.co.in. It provides details on: 1. The source and destination hosts, ICMP type and code values, and fields contained in ICMP echo request and reply packets. 2. How traceroute works by sending UDP packets with incrementing TTL values, which triggers ICMP time exceeded messages from routers, and finally a destination unreachable message from the target host. 3. The analysis found no significant delay between hops in the traceroute.

Uploaded by

mhrkelkar
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as ODT, PDF, TXT or read online on Scribd
55 views4 pages

W W W .Goog L E.co. I N

The document discusses using Wireshark to capture ICMP packets from pinging google.co.in and using traceroute to trace the route to google.co.in. It provides details on: 1. The source and destination hosts, ICMP type and code values, and fields contained in ICMP echo request and reply packets. 2. How traceroute works by sending UDP packets with incrementing TTL values, which triggers ICMP time exceeded messages from routers, and finally a destination unreachable message from the target host. 3. The analysis found no significant delay between hops in the traceroute.

Uploaded by

mhrkelkar
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as ODT, PDF, TXT or read online on Scribd
You are on page 1/ 4

Lab 7:- Capturing ICMP with Wireshark 110903067 -Chinmay Kulkarni ping www.google.co.in 1). Source Host :- 10.1.11.

138 Destination Host:- 74.125.236.56

2). ICMP operates at the IP level, so PING tests the reachability of the IP layer only in the destination machine. The ICMP messages do not enter layers above IP. The destination port address and the source port addresses operate at the Transport Layer. Hence the ICMP messages do not have fields for them.

3). Here the value of the ICMP type is 8 and code value is 0. A type 8 ICMP message is echo request message. The ICMP packet has three other fields ICMP header checksum, identifier and Sequence Number. All these three fields occupy 16 bits. the Type and header individually occupy 8 bits each. 4). Here the packet is a type 0 ICMP echo reply . And the code is again a 0. The ICMP packet has the same three fields Checksum, identifier and the sequence number. The sequence number and the identifier fields remain unaltered. Only the checksum changes.The checksum ,identifer and sequence number occupy 16 bits each. Both the echo reply and request are query ICMP messages.

traceroute www.google.co.in 1). Source Host :- 10.1.11.1 Target Destination Host :- 74.125.236.216 2). If ICMP sent UDP packets instead, the IP Protocol would not be 01. But however then it will change to 0x11 that is 17 which is used to represent UDP. 3). The ICMP traceroute packets are different from the ICMP ping packets. The ICMP packet contains the IP header and the first 8 bytes of original datagram's data. The type number for the ICMP traceroute packet is 11 whereas for the ping the ICMP type was 8. Ping ICMP is a query packet. whereas the traceroute packet is an error packet to indicate that the time to live has exceeded.

4). The fields included in the ICMP header are Type(Value 11), Code and Header Checksum, and the IP header as well as the first 8 bytes of original datagram data which was discarded by the router. In the echo request packet the type was 8, and instead of the IP header it had Identifier and sequence number and some additional data. 5). The last three ICMP packets recieved by the source host are Destination port unreachable. All the other ICMP packets received by the host were Exceeded time to live error messages. The traceroute basically works on the principle that first a packet with time to live value is sent. This gets exhausted at the first hop. So the first router discards it and sends a ICMP error message. The time to live value is then incremented and same procedure is followed.Hence the intermediate routers can be determined. This keeps going until you reach the destination. Since you are sending UDP packets with the destination address of the host you are concerned with, once it gets to the destination the UDP packet is wanting to connect to the port that you have sent as the destination port, since it is an uncommon port, it will most like be rejected with an ICMP Destination Unreachable (Type 3), Port Unreachable (Code 3). This ICMP message is sent back to your machine, which will understand this as being the last hop,

therefore traceroute will exit, giving you the hops between you and the destination.

6). No there is no link where the delay is significantly greater than others. Except at the second hop when the message is redirected out of the local ISP.

You might also like