MITS4004 Research Study: Networking Lab Report Analysis of ICMP and IP

This MITS4004 research study lab report analyzes ICMP (Internet Control Message Protocol) and IP (Internet Protocol) using Wireshark. The report includes hands-on exercises involving ping and traceroute commands to examine ICMP echo requests and replies, as well as the use of ICMP for network diagnostics. The analysis extends to IPv4, dissecting IP datagrams, examining header fields, and investigating fragmentation. The lab explores the structure and function of ICMP and IP packets, covering topics such as packet headers, protocol fields, and the role of ICMP in network troubleshooting. Students examined network traffic to answer specific questions about IP addresses, protocol numbers, and datagram characteristics, including fragmentation and TTL values. The report also includes comparison of fields and values across different packet types.

Running Head: MITS4004 RESEARCH STUDY
MITS4004 Research Study : Networking
[Student Name]
[University Name]

1MITS4004 RESEARCH STUDY
Table of Contents
Wireshark Lab: ICMP v6.0........................................................................................................2
ICMP and Ping.......................................................................................................................2
ICMP and Traceroute.............................................................................................................7
Wireshark Lab: IP v6.0............................................................................................................12

2MITS4004 RESEARCH STUDY
Wireshark Lab: ICMP v6.0
ICMP and Ping
Run Ping Command in command prompt
C:\Windows\System32>ping -n 10 www.ece.ust.hk
Pinging www.ece.ust.hk [143.89.44.246] with 32 bytes of data:
Reply from 143.89.44.246: bytes=32 time=104ms TTL=44
Reply from 143.89.44.246: bytes=32 time=104ms TTL=44
Reply from 143.89.44.246: bytes=32 time=104ms TTL=44
Reply from 143.89.44.246: bytes=32 time=103ms TTL=44
Reply from 143.89.44.246: bytes=32 time=104ms TTL=44
Reply from 143.89.44.246: bytes=32 time=103ms TTL=44
Reply from 143.89.44.246: bytes=32 time=103ms TTL=44
Reply from 143.89.44.246: bytes=32 time=104ms TTL=44

3MITS4004 RESEARCH STUDY
Reply from 143.89.44.246: bytes=32 time=104ms TTL=44
Reply from 143.89.44.246: bytes=32 time=104ms TTL=44
Ping statistics for 143.89.44.246:
Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 103ms, Maximum = 104ms, Average = 103ms
C:\Windows\System32>
Wireshark Packet Capture of Ping Command
Answers

4MITS4004 RESEARCH STUDY
1. IP address of the host is 10.10.30.148. IP address of the destination host is
143.89.44.246
2. ICMP packet communicate network layer information between hosts and routers.
Therefore, ICMP packets does not have the source and destination port number.
3. ICMP packet brief
Frame 976: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0
Interface id: 0 (\Device\NPF_{57C7D7B6-27B9-4DA4-A941-901908A75822})
Encapsulation type: Ethernet (1)
Arrival Time: Jan 22, 2019 18:53:46.882458000 India Standard Time
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1548163426.882458000 seconds
[Time delta from previous captured frame: 0.037381000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 17.737885000 seconds]
Frame Number: 976
Frame Length: 74 bytes (592 bits)
Capture Length: 74 bytes (592 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ip:icmp:data]
[Coloring Rule Name: ICMP]
[Coloring Rule String: icmp || icmpv6]
Ethernet II, Src: 58:8a:5a:40:59:64 (58:8a:5a:40:59:64), Dst: Sophos_49:1c:a8
(7c:5a:1c:49:1c:a8)

5MITS4004 RESEARCH STUDY
Destination: Sophos_49:1c:a8 (7c:5a:1c:49:1c:a8)
Source: 58:8a:5a:40:59:64 (58:8a:5a:40:59:64)
Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 10.10.30.148, Dst: 143.89.44.246
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
Total Length: 60
Identification: 0x3846 (14406)
Flags: 0x00
Fragment offset: 0
Time to live: 128
Protocol: ICMP (1)
Header checksum: 0x0000 [validation disabled]
[Header checksum status: Unverified]
Source: 10.10.30.148
Destination: 143.89.44.246
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Internet Control Message Protocol
Type: 8 (Echo (ping) request)
Code: 0
Checksum: 0x47bc [correct]
[Checksum Status: Good]
Identifier (BE): 1 (0x0001)

6MITS4004 RESEARCH STUDY
Identifier (LE): 256 (0x0100)
Sequence number (BE): 1439 (0x059f)
Sequence number (LE): 40709 (0x9f05)
[Response frame: 978]
Data (32 bytes)
ICMP type 8 and code number 0. There are many other fields such as Checksum, Sequence
number, Identifier, data. 2 bytes each.
4. Replay Ping Packets
Internet Control Message Protocol
Type: 0 (Echo (ping) reply)
Code: 0
Checksum: 0x4fbc [correct]
[Checksum Status: Good]
Identifier (BE): 1 (0x0001)
Identifier (LE): 256 (0x0100)
Sequence number (BE): 1439 (0x059f)
Sequence number (LE): 40709 (0x9f05)
[Request frame: 976]
[Response time: 103.816 ms]
Data (32 bytes)
Data: 6162636465666768696a6b6c6d6e6f707172737475767761...
[Length: 32]

7MITS4004 RESEARCH STUDY
ICMP type and Code number is 0 and 0. There are many other fields such as
Checksum, Sequence number, Identifier, data. Total 32 bytes are in these fields.
ICMP and Traceroute
C:\Windows\System32>tracert www.inria.fr
Tracing route to ezp3.inria.fr [128.93.162.84]
over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms 10.10.30.1
2 1 ms 2 ms 1 ms Kol-223.29.204.241.PMPL-Broadband.net [223.29.204.241]
3 2 ms 1 ms 1 ms 10.2.5.1
4 1 ms <1 ms <1 ms 22.22.22.1
5 2 ms 1 ms 1 ms 10.100.100.61

8MITS4004 RESEARCH STUDY
6 1 ms 1 ms 1 ms 10.200.30.2
7 * * * Request timed out.
8 * * * Request timed out.
9 <1 ms 1 ms 1 ms 10.200.10.1
10 3 ms 3 ms 3 ms 220.225.118.117
11 30 ms 29 ms 29 ms sriperumbudur-eg-173.232.249.45.powergrid.in
[45.249.232.173]
12 30 ms 29 ms 30 ms chennai-igw-172.232.249.45.powergrid.in [45.249.232.172]
13 31 ms 31 ms 31 ms 115.249.226.130
14 57 ms 56 ms 57 ms 115.255.253.146
15 53 ms 61 ms 53 ms 62.216.147.45
16 177 ms 175 ms 186 ms xe-3-1-0.0.cjr01.prs001.flagtel.com [85.95.25.114]
17 171 ms 173 ms 172 ms ge-5-0-0.0.ejr02.prs002.flagtel.com [62.216.128.198]
18 * * * Request timed out.
19 183 ms 183 ms 183 ms 193.51.180.44
20 194 ms 195 ms 194 ms te1-1-inria-rtr-021.noc.renater.fr [193.51.177.107]
21 183 ms 183 ms 183 ms inria-rocquencourt-te1-4-inria-rtr-021.noc.renater.fr
[193.51.184.177]
22 183 ms 183 ms 182 ms unit240-reth1-vfw-ext-dc1.inria.fr [192.93.122.19]
23 180 ms 179 ms 179 ms ezp3.inria.fr [128.93.162.84]
Trace complete.
C:\Windows\System32>

9MITS4004 RESEARCH STUDY
Frame 397: 106 bytes on wire (848 bits), 106 bytes captured (848 bits) on interface 0
Interface id: 0 (\Device\NPF_{57C7D7B6-27B9-4DA4-A941-901908A75822})
Encapsulation type: Ethernet (1)
Arrival Time: Jan 22, 2019 19:40:58.555045000 India Standard Time
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1548166258.555045000 seconds
[Time delta from previous captured frame: 0.022576000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 28.423130000 seconds]
Frame Number: 397
Frame Length: 106 bytes (848 bits)
Capture Length: 106 bytes (848 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ip:icmp:data]

10MITS4004 RESEARCH STUDY
[Coloring Rule Name: ICMP]
[Coloring Rule String: icmp || icmpv6]
Ethernet II, Src: 58:8a:5a:40:59:64 (58:8a:5a:40:59:64), Dst: Sophos_49:1c:a8
(7c:5a:1c:49:1c:a8)
Destination: Sophos_49:1c:a8 (7c:5a:1c:49:1c:a8)
Source: 58:8a:5a:40:59:64 (58:8a:5a:40:59:64)
Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 10.10.30.148, Dst: 128.93.162.84
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
Total Length: 92
Identification: 0x783d (30781)
Flags: 0x00
Fragment offset: 0
Time to live: 1
Protocol: ICMP (1)
Header checksum: 0x0000 [validation disabled]
[Header checksum status: Unverified]
Source: 10.10.30.148
Destination: 128.93.162.84
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Internet Control Message Protocol
Type: 8 (Echo (ping) request)

11MITS4004 RESEARCH STUDY
Code: 0
Checksum: 0xf255 [correct]
[Checksum Status: Good]
Identifier (BE): 1 (0x0001)
Identifier (LE): 256 (0x0100)
Sequence number (BE): 1449 (0x05a9)
Sequence number (LE): 43269 (0xa905)
[No response seen]
Data (64 bytes)
Data: 000000000000000000000000000000000000000000000000...
[Length: 64]
5. IP address of the host is 10.10.30.148. IP address of the destination host is
128.93.162.84
6. No. If ICMP sent UDP packets instead, the IP protocol number should be 0x11
7. No, both packets are same fields. They are not different.