Hong Quc Vng

Nguyn Trng Tun

Lp: CNTT-K54
H v tn :

MSSV :

5451074092
5451074084

Cu 1: Select the first ICMP Echo Request message sent by your computer, and
expand the Internet Protocol part of the packet in the packet details window.

IP address of my computer: 192.168.10.219

Cu 2:Within the IP packet header, what is the value in the upper layer protocol
field?

Quoc Vuong Hoang

Trang 1

The value of the update layer protocol is 0x01.

Cu 3: How many bytes are in the IP header? How many bytes are in the payload of
the IP datagram? Explain how you determined the number of payload bytes.

Header length: 20 bytes

Payload = Total Length: 56 header length:20 = 36 bytes.
Cu 4: Has this IP datagram been fragmented? Explain how you determined
whether or not the datagram has been fragmented.

The fragment offset is set to 0, therefore, the packet has not been fragmented.

Quoc Vuong Hoang

Trang 2

Cu 5: Which fields in the IP datagram always change from one datagram to the
next within this series of ICMP messages sent by your computer?
The checksum always changes and so does the sequence number

Cu 6: Which fields stay constant? Which of the fields must stay constant? Which
fields must change? Why?

Header length and time to live stay constant because these are preset. The fragment
number, sequence number, flags, total length and checksum very from each segment so
they change.
Cu 7: Describe the pattern you see in the values in the Identification field of the IP
datagram.
The value of the identification field is incremented by 1 on every new outgoing message.
Cu 8: What is the value in the Identification field and the TTL field?

Quoc Vuong Hoang

Trang 3

Identification: 0x25d7 (9687)

Time to live: 64
Cu 9: Do these values remain unchanged for all of the ICMP TTL-exceeded replies
sent to your computer by the nearest (first hop) router? Why?

The identification field changes in the ICMP TTL-exceeded replies for it needs to be
unique. The time to live remains the same as it is a constant.

Cu 10: Find the first ICMP Echo Request message that was sent by your computer
after you changed the Packet Size in pingplotter to be 2000. Has that message been
fragmented across more than one IP datagram?
Yes, it has been fragmented.

Cu 11: Print out the first fragment of the fragmented IP datagram. What
information in the IP header indicates that the datagram been fragmented? What
information in the IP header indicates whether this is the first fragment versus a
latter fragment?
How long is this IP datagram

Quoc Vuong Hoang

Trang 4

The more fragments bit is set to 1 indicates that the datagram has been fragmented.
Since the fragment offset is set to 0 this indicates that this is the first fragment.
The datagrams length is set to 2000
Cu 12: Print out the second fragment of the fragmented IP datagram. What
information in the IP header indicates that this is not the first datagram
fragment? Are the more fragments? How can you tell?
Since fragment offset is set to 2000 this shows that it is not the first fragment.
Since the more fragments bit is set to zero this indicates there are no more fragments.

Quoc Vuong Hoang

Trang 5

Cu 13: What fields change in the IP header between the first and second fragment?
The fields that change are the flags, header checksum, total length and fragment offset

Cu 14: How many fragments were created from the original datagram?
Quoc Vuong Hoang

Trang 6

3 fragments were created from the original datagram.

Cu 15. What fields change in the IP header among the fragments?

Fragment offset, total length, more fragments bit, TTL and the checksum.

PHN II : LAB 7

Cu 1: What is the IP address of the client?

192.168.1.100
Cu 2: The client actually communicates with several different Google servers in
order to
Quoc Vuong Hoang

Trang 7

implement safe browsing. (See extra credit section at the end of this lab). The
main Google server that will serve up the main Google web page has IP address
64.233.169.104. In order to display only those frames containing HTTP messages
that are sent to/from this Google, server, enter the expression http && ip.addr ==
64.233.169.104 (without quotes) into the Filter: field in Wireshark .
Cu 3: Consider now the HTTP GET sent from the client to the Google server
(whose IP address is IP address 64.233.169.104) at time 7.102967. What are the
source and destination IP addresses and TCP source and destination ports on the IP
datagram carrying this HTTP GET?
Answer: Source: 192.168.1.100, 4335 Destination: 64.233.169.104, 80

Cu 4: At what time is the corresponding 200 OK HTTP message received from the Google server?
What are the source and destination IP addresses and TCP source and destination ports on the IP
datagram carrying this HTTP 200 OK message?
Answer: Source: 64.233.169.104, 80 Destination: 192.168.1.100, 4335

Quoc Vuong Hoang

Trang 8

Quoc Vuong Hoang

Trang 9