Wireshark IP Routing

Wireshark IP RoutingIntroductionTo complete this study, I chip in had three practical(prenominal) machines running at once. Two of these Virtual Machines were running Ubuntu and adept was running FREEBSD acting like a router between the two Ubuntu machines. Configured sever onlyy machine to the specified IP addresses beforehand and deal two NAT electronic networks up as required in the study. Once all was set up I double checked IP addresses of both Ubuntu machines by fount terminal and typing in ifconfig which then confirmed that both machines networks were working(a) correctly. Further to a greater extent(prenominal), I have used the ping command to send an ICMP piece of land to NAT Networks to confirm both Ubuntu machines atomic number 18 connected to the right network. (See below) Fig.1 ifconfigFig.2 ping NAT NetworkFig.3 ICMP reverberation indicate message IP informationSelect the root ICMP come back Request message move by your computer, and expand the lucre Pro tocol part of the packet in the packet details window. What is the IP address of your computer?The IP Address of my computer is 10.0.3.4 . I set up this out by looking at the Source and thats where packets were sent from so I know that testament be my IP address as well as in the Internet Protocol version 4 it says Src 10.0.3.4.Within the IP packet aim, what is the value in the upper layer protocol survey?Within the aim, the value in the upper layer protocol line of business is ICMP(1).How many another(prenominal) bytes are in the IP header? How many bytes are in the payload of the IP datagram? Explain how you located the number of payload bytes.There are 20 bytes in the IP header and 60 bytes total distance this gives 40 bytes in the payload of the IP datagram. To determine the number of payload bytes all you need to do is take away the IP header size which in this case is 20bytes from the total length which in this case is 60 bytes and the remainder is the number of payload bytes.Has this IP datagram been sectioned? Explain how you determined whether or not the datagram has been staccato.The more fragments is= 0 so the data is not fragmented. I looked at the Flags drop subject and there it determines if a packet is fragmented or not and in this case more fragments was 0 likewise Fragment set out is also =0.Which fields in the IP datagram always convert from one datagram to the close within this series of ICMP messages sent by your computer?Time to live, appointment and Header checksum always change. The identification is a unique number appoint to to each one packet so it always has to change as a result of this the Header checksum leave change and the Time to live will change with it too.Which fields incumbrance on constant? Which of the fields must(prenominal) stay constant? Which fields must change? Why?The fields that stay constant across the IP datagrams are Version (since we are victimisation IPv4 for all packets)Header len gth (since these are ICMP packets)Source IP (since we are direct from the homogeneous source)Destination IP (since we are sending to the same destination) tell receiptss (since all packets are ICMP they use the same slip of Service class)Upper Layer Protocol (since these are ICMP packets)The fields that must stay constant areVersion (since we are using IPv4 for all packets)Header length (since these are ICMP packets)Source IP (since we are sending from the same source)Destination IP (since we are sending to the same dest)Differentiated Services (since all packets are ICMP they use the same Type of Service class)Upper Layer Protocol (since these are ICMP packets)The fields that must change are appellative(IP packets must have different ids)Time to live (traceroute increments each subsequent packet)Header checksum (since header changes, so must checksum)Describe the configuration you see in the values in the Identification field of the IP datagramIP header Identification fields i ncrement with each ICMP telephone (ping) request. I found this out by scrolling through each ICMP Echo request (ping) and looking at how Identification field values change.Fig.4 ICMP TTL exceeded reply, IP InfoWhat is the value in the Identification field and the TTL field?Identification 0x01a9(425)TTL64Do these values remain unvarying for all of the ICMP TTL-exceeded replies sent to your computer by the nearest ( primary hop) router? Why?The TTL will remain unchanged because the outgrowth hop router is always the same. Identification field for all ICMP TTL-exceeded replies will change because it is assigned a unique value. When two or more IP datagrams have the same identification value that means that these IP datagrams are fragments of a single large IP datagram.Fig.5 ICMP Echo Request packet size = 2000, First segment10. Find the inaugural ICMP Echo Request message that was sent by your computer after you changed the sheaf Size in pingplotter to be 2000. Has that message be en fragmented across more than one IP datagram?Yes, this packet has been fragmented across more than one IP datagram. I found this out by looking at the info tab on my Wireshark as it clearly states Fragmented IP also, I checked each one to see under Flags if the more than segments is set to a value or not.11. Print out the first fragment of the fragmented IP datagram. What information in the IP header indicates that the datagram been fragmented? What information in the IP header indicates whether this is the first fragment versus a latter fragment? How long is this IP datagram? Under the Flags pungency for More Fragments it is showing that the datagram has been fragmented. Since the fragment offset is 0, we know that this is the first fragment. This first datagram has a total length of 1500 including the header. Fig.6 ICMP Echo Request packet size= 2000, second fragmentPrint out the second fragment of the fragmented IP datagram. What information in the IP header indicates that th is is not the first datagram fragment? Are the more fragments? How give the gate you tell?I can tell that this is not the first fragment since the fragment offset is 1480. It is the brave out fragment since the more fragments flag is not set.What fields change in the IP header between the first and second fragment?The IP header fields that changed between the fragments are total length, flags, fragment offset and checksum. Fig.7 ICMP Echo Request packet size=3500, first fragmentHow many fragments were created from the trustworthy datagram?After switching to 3500, there are 3 packets created from original datagram.What fields change in the IP header among the fragments?The IP header fields that changed between all of the packets are fragment offset and checksum. amidst the first two packets and the culture packet, we see a change in total length also in the flags. The first two packets have the total length of 1500 with more fragments bit set to 1 and the last packet has a total length of 540 with more fragments bit set to 0.