Scribd
Upload
230 views2 pages

Wireshark Lab: ICMP

The document discusses two ICMP network tools: ping and traceroute. It provides instructions on using each tool in Windows and analyzing the network packets with Wireshark. Students are asked to run the tools, capture packets, and answer questions about the IP addresses and ICMP packet fields in the captures.

Uploaded by

محمد عيد
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
230 views2 pages

Wireshark Lab: ICMP

The document discusses two ICMP network tools: ping and traceroute. It provides instructions on using each tool in Windows and analyzing the network packets with Wireshark. Students are asked to run the tools, capture packets, and answer questions about the IP addresses and ICMP packet fields in the captures.

Uploaded by

محمد عيد
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 2

Wireshark Lab: ICMP

In this lab, you will explore several aspects of the ICMP protocol.

1. ICMP and Ping


Do the following:
 Open the Windows Command Prompt application.
 Start up the Wireshark packet sniffer, and begin Wireshark packet capture.
 Type ping –n 10 www.google.com in the MS-DOS command line. The argument
“-n 10” indicates that 10 ping messages should be sent.
 When the Ping program terminates, stop the packet capture in Wireshark.
 Enter “icmp” into the filter display window to show information only about the
ICMP protocol.

What to Submit:
 Provide a screenshot of the Command Prompt window (where you run the Ping
program).
 Answer the following questions:
In order to answer the following questions, you will need to look into the packet details
and packet contents windows. When answering a question you should provide a
screenshot of the packet(s) in Wireshark that you used to answer the question asked.

1. What is the IP address of your host? What is the IP address of the destination
host?
2. Examine one of the ping request packets sent by your host. What are the ICMP
type and code numbers? What other fields does this ICMP packet have? How
many bytes are the checksum, sequence number and identifier fields?
3. Examine the corresponding ping reply packet. What are the ICMP type and code
numbers? What other fields does this ICMP packet have? How many bytes are the
checksum, sequence number and identifier fields?

2. ICMP and Traceroute


Traceroute is implemented in different ways in Unix/Linux and in Windows. In
Unix/Linux, the source sends a series of UDP packets to the target destination using an
unlikely destination port number; in Windows, the source sends a series of ICMP packets
to the target destination. For both operating systems, the program sends the first packet
with TTL=1, the second packet with TTL=2, and so on. In the following, you will use the
Windows tracert program.

© 2005-21012, J.F Kurose and K.W. Ross, All Rights Reserved


Do the following:
 Open the Windows Command Prompt application.
 Start up the Wireshark packet sniffer, and begin Wireshark packet capture.
 Type tracert www.inria.fr in the MS-DOS command line. (Note that on a
Windows machine, the command is “tracert” and not “traceroute”.)
 When the Traceroute program terminates, stop packet capture in Wireshark.

What to Submit:
 Provide a screenshot of the Command Prompt window (where you run the tracert
program).

 Answer the following questions:


In order to answer the following questions, you will need to look into the packet details
and packet contents windows. When answering a question you should provide a
screenshot of the packet(s) in Wireshark that you used to answer the question asked.
4. What is the IP address of your host? What is the IP address of the target
destination host?
5. If ICMP sent UDP packets instead (as in Unix/Linux), would the IP protocol
number still be “01” for the probe packets? If not, what would it be?
6. Examine the ICMP echo packet in your screenshot. Is this different from the
ICMP ping query packets in the first part of this lab? If yes, how so?
7. Examine the ICMP error packet in your screenshot. It has more fields than the
ICMP echo packet. What is included in those fields?
8. Examine the last ICMP packet received by the source host. How is this packet
different from the ICMP error packets? Why is it different?

© 2005-21012, J.F Kurose and K.W. Ross, All Rights Reserved

You might also like