Understanding ICMP And IP Packet Headers And Fields

ICMP Packets and Their Structure

The IP address of the host is 10.10.30.49. The IP address of the destination host is  143.89.44.246.

The ICMP is designed for communicating with the network-layer information in between the routers and the host and not within the application layer processes. Hence, the ICMP packet does not have source and destination port numbers.

The ICMP type is 8 and the code number is 0. The other fields that the ICMP packet have are checksum, identifier (BE), identifier (LE), sequence number (BE) and sequence number (LE). The checksum, sequence number and identifier fields are of 2 bytes.

The ICMP type is 0 and the code number is 0. The other fields that the ICMP packet have are checksum, identifier (BE), identifier (LE), sequence number (BE) and sequence number (LE). The checksum, sequence number and identifier fields are of 2 bytes.

The IP address of the host is 10.10.30.49. The IP address of the destination host is  128.93.162.84.

If ICMP sent UDP packets instead (as in Unix/Linux), would the IP protocol number will not be 01. It would be 0x11.

The ICMP echo packet is same with that of the ICMP ping query packets in the first half of this lab as the fields identified in the first half of this lab is same with that of the ICMP echo packet.

The additional fields in the error packets are the differentiated services field, the time to live field, flag fields and the header filed. It contains 4 bytes of the error packets.

The last three ICMP packets received by the source host are type 0 while the error packets are of type 8. In addition to this, the ICMP packets received by the host has time to live 49, however the error packets have a time to live 1.

Yes, there is link in between hop 7 and 8, which is significantly higher than the rest. The possible location of the routers are Mumbai and Marseille.

The IP address in the computer is 10.10.10.49.

The value in the upper layer protocol field is ICMP (1).

There are 20 bytes in the IP header.  The payload length = the total length – the IP header length. Therefor the length of the payload of the IP datagram is 56 – 20 bytes = 30 bytes.

The IP datagram has not been fragmented. It has been seen that fragmented bit is equal to 0. Hence, we come to the conclusion that the IP datagram has not been fragment.

Fields in ICMP Packets

The identification field and the time to live is always incremental from on datagram to the next datagram.  

The fields that stay constant in the ICMP messages are the versions, header length, source IP, destination and the Upper layer protocol. The version provides the information about the IPv4 addresses, the header length provides the ICMP packets, the source IP, the destination IP remains same as the source, and destination is same for all the packets.

The fields that change for the ICMP are the identification filed, the time to live field and the header checksum field. This is because each of the IP packets should be having a unique ID, the traceroutes provide an increment for each of the subsequent ICMP. Additonally, the header checksum changes due to the change taking place in the headers.

The pattern identified is that each of the IP header identification fields get incremented as each of the ICMP Echo is requested.

The value in the identification field is 20692 and the value in the TTL field is 255.

There is a change in the value of the identification field every time there is ping request as there is a unique value for each of the identification fields. In case there are two or more IP datagrams that have the same identification values, then it implies that the IP datagrams are fragments of a same datagram.

There have been no fragments in the message. The fragments option displays this which proves the fact.  

There is no fragmentation as there is fragments is not set. The first fragment is of a total length of 540.

The second fragment indicates that there has been a change in the fragment offset and the it is set to 370. Hence, it indicates that there has been a fragmentation that was not done for the previous datagram.

The IP header files which changed in the between the first and the second fragment is fragment offset and checksum.

3 fragments were created from the original datagram.

The flag changes in the IP header among the fragments

References

Nakibly, G., Schcolnik, J., & Rubin, Y. (2016, August). Website-Targeted False Content Injection by Network Operators. In USENIX Security Symposium (pp. 227-244).

Taylor, A., Leblanc, S., & Japkowicz, N. (2016, October). Anomaly detection in automobile control network data with long short-term memory networks. In Data Science and Advanced Analytics (DSAA), 2016 IEEE International Conference on (pp. 130-139). IEEE.