Wireshark Lab 4: IP

(NOTE: I'm using the capture file provided by the book's authors because the traceroute program wasn't working as it should)

1. 192.168.1.102

2. ICMP (1)

3.  There are 20 bytes in the IP header. There should be 36 bytes in the payload, since the packet size was 56 bytes and the header size is 20 bytes.

4. They do appear to be fragmented, as there are many IPv4 packet fragments in the capture window.

5. The TTL (Time To Live) is different in each one. The identification field also changes.

6. The host, destination, header size and fragment offset fields all stay the same.

7. The identification field changes by one for each new packet.

8. The TTL is 254, and the identification field is 0.

9. Yes, the values stay constant for all the TTL exceeded replies from that particular router.

10. Yes, it has been fragmented across more than one IP datagram.

11. I know this packet is fragmented because there is a field that says "Reassembled IPv4 in frame 100", which implies that it is a fragment. This datagram fragment is 1480 bytes.

12. There doesn't seem to be anything in the header that indicates that it is not the first fragment. There are more fragments, I can tell by looking in the capture window.

13. Identification and Time To Live are the fields that get changed between fragments.

14. Two fragments were created from the original datagram.

15. The Time To Live, header checksum and fragment offset fields all change between the fragments.