Data Communication: ICMP and Ping, ICMP and Traceroute, Captured Trace, Fragmentation

This document discusses ICMP and Ping, ICMP and Traceroute, Captured Trace, and Fragmentation in Data Communication. It covers topics like IP address, ICMP packet, ping request packets, ICMP error packet, traceroute measurements, IP datagram, fragmentation, and more.

Running head: DATA COMMUNICATION
Data Communication
Name of the Student:
Name of the University:
Author Note

1
DATA COMMUNICATION
ICMP and Ping
1. What is the IP address of your host? What is the IP address of the
destination host?
The IP address of the host is 10.10.30.49. The IP address of the destination host is
143.89.44.246.

2
DATA COMMUNICATION
2. Why is it that an ICMP packet does not have source and destination port
numbers?
The ICMP is designed for communicating with the network-layer information in
between the routers and the host and not within the application layer processes. Hence, the
ICMP packet does not have source and destination port numbers.
3. Examine one of the ping request packets sent by your host. What are the
ICMP type and code numbers? What other fields does this ICMP packet have?
How many bytes are the checksum, sequence number and identifier fields?
The ICMP type is 8 and the code number is 0. The other fields that the ICMP packet
have are checksum, identifier (BE), identifier (LE), sequence number (BE) and sequence
number (LE). The checksum, sequence number and identifier fields are of 2 bytes.

3
DATA COMMUNICATION
4. Examine the corresponding ping reply packet. What are the ICMP type and
code numbers? What other fields does this ICMP packet have? How many bytes
are the checksum, sequence number and identifier fields?
The ICMP type is 0 and the code number is 0. The other fields that the ICMP packet
have are checksum, identifier (BE), identifier (LE), sequence number (BE) and sequence
number (LE). The checksum, sequence number and identifier fields are of 2 bytes.

4
DATA COMMUNICATION
ICMP and Traceroute

5
DATA COMMUNICATION
5. What is the IP address of your host? What is the IP address of the target
destination host?
The IP address of the host is 10.10.30.49. The IP address of the destination host is
128.93.162.84.
6. If ICMP sent UDP packets instead (as in Unix/Linux), would the IP protocol
number still be 01 for the probe packets? If not, what would it be?
If ICMP sent UDP packets instead (as in Unix/Linux), would the IP protocol number
will not be 01. It would be 0x11.
7. Examine the ICMP echo packet in your screenshot. Is this different from the
ICMP ping query packets in the first half of this lab? If yes, how so?
The ICMP echo packet is same with that of the ICMP ping query packets in the first
half of this lab as the fields identified in the first half of this lab is same with that of the ICMP
echo packet.

6
DATA COMMUNICATION
8. Examine the ICMP error packet in your screenshot. It has more fields than the
ICMP echo packet. What is included in those fields?
The additional fields in the error packets are the differentiated services field, the time
to live field, flag fields and the header filed. It contains 4 bytes of the error packets.
9. Examine the last three ICMP packets received by the source host. How are
these packets different from the ICMP error packets? Why are they different?
The last three ICMP packets received by the source host are type 0 while the error
packets are of type 8. In addition to this, the ICMP packets received by the host has time to
live 49, however the error packets have a time to live 1.
10. Within the tracert measurements, is there a link whose delay is significantly
longer than others? Refer to the screenshot in Figure 4, is there a link whose
delay is significantly longer than others? On the basis of the router names, can
you guess the location of the two routers on the end of this link?
Yes, there is link in between hop 7 and 8, which is significantly higher than the rest.
The possible location of the routers are Mumbai and Marseille.

7
DATA COMMUNICATION
A look at the captured trace

8
DATA COMMUNICATION
1. Select the first ICMP Echo Request message sent by your computer, and
expand the Internet Protocol part of the packet in the packet details window.
What is the IP address of your computer?
The IP address in the computer is 10.10.10.49.
2. Within the IP packet header, what is the value in the upper layer protocol
field?
The value in the upper layer protocol field is ICMP (1).
3. How many bytes are in the IP header? How many bytes are in the payload of
the IP datagram? Explain how you determined the number of payload bytes.
There are 20 bytes in the IP header. The payload length = the total length – the IP
header length. Therefor the length of the payload of the IP datagram is 56 – 20 bytes = 30
bytes.
4. Has this IP datagram been fragmented? Explain how you determined whether
or not the datagram has been fragmented.
The IP datagram has not been fragmented. It has been seen that fragmented bit is
equal to 0. Hence, we come to the conclusion that the IP datagram has not been fragment.
5. Which fields in the IP datagram always change from one datagram to the next
within this series of ICMP messages sent by your computer?
The identification field and the time to live is always incremental from on datagram to
the next datagram.

9
DATA COMMUNICATION
6. Which fields stay constant? Which of the fields must stay constant? Which
fields must change? Why?
The fields that stay constant in the ICMP messages are the versions, header length,
source IP, destination and the Upper layer protocol. The version provides the information
about the IPv4 addresses, the header length provides the ICMP packets, the source IP, the
destination IP remains same as the source, and destination is same for all the packets.
The fields that change for the ICMP are the identification filed, the time to live field
and the header checksum field. This is because each of the IP packets should be having a
unique ID, the traceroutes provide an increment for each of the subsequent ICMP.
Additonally, the header checksum changes due to the change taking place in the headers.
7. Describe the pattern you see in the values in the Identification field of the IP
datagram
The pattern identified is that each of the IP header identification fields get
incremented as each of the ICMP Echo is requested.
8. What is the value in the Identification field and the TTL field?
The value in the identification field is 20692 and the value in the TTL field is 255.
9. Do these values remain unchanged for all of the ICMP TTL-exceeded replies
sent to your computer by the nearest (first hop) router? Why?
There is a change in the value of the identification field every time there is ping
request as there is a unique value for each of the identification fields. In case there are two or
more IP datagrams that have the same identification values, then it implies that the IP
datagrams are fragments of a same datagram.

10
DATA COMMUNICATION
Fragmentation
10. Find the first ICMP Echo Request message that was sent by your computer
after you changed the Packet Size in pingplotter to be 2000. Has that message
been fragmented across more than one IP datagram?
There have been no fragments in the message. The fragments option displays this
which proves the fact.

11
DATA COMMUNICATION
11. Print out the first fragment of the fragmented IP datagram. What
information in the IP header indicates that the datagram been fragmented?
What information in the IP header indicates whether this is the first fragment
versus a latter fragment? How long is this IP datagram?
There is no fragmentation as there is fragments is not set. The first fragment is of a total
length of 540.

12
DATA COMMUNICATION
12. Print out the second fragment of the fragmented IP datagram. What
information in the IP header indicates that this is not the first datagram
fragment? Are the more fragments? How can you tell?
The second fragment indicates that there has been a change in the fragment offset and
the it is set to 370. Hence, it indicates that there has been a fragmentation that was not done
for the previous datagram.
13. What fields change in the IP header between the first and second fragment?
The IP header files which changed in the between the first and the second fragment is
fragment offset and checksum.
14. How many fragments were created from the original datagram?
3 fragments were created from the original datagram.
15. What fields change in the IP header among the fragments?
The flag changes in the IP header among the fragments.

13
DATA COMMUNICATION
Bibliography
Nakibly, G., Schcolnik, J., & Rubin, Y. (2016, August). Website-Targeted False Content
Injection by Network Operators. In USENIX Security Symposium (pp. 227-244).
Taylor, A., Leblanc, S., & Japkowicz, N. (2016, October). Anomaly detection in automobile
control network data with long short-term memory networks. In Data Science and
Advanced Analytics (DSAA), 2016 IEEE International Conference on (pp. 130-139).
IEEE.