Wireshark Lab: IP v7.0

实验文件地址

http://www-net.cs.umass.edu/wireshark-labs/Wireshark_IP_v7.0.pdf

Question & Answer

1. Select the first ICMP Echo Request message sent by your computer, and expand the Internet Protocol part of the packet in the packet details window. What is the IP address of your computer?

2. Within the IP packet header, what is the value in the upper layer protocol field?

3. How many bytes are in the IP header? How many bytes are in the payload of the IP datagram? Explain how you determined the number of payload bytes.

There are 20 bytes in the IP header
The length of the payload of the IP datagram is 84 - 20 = 64 bytes.

4. Has this IP datagram been fragmented? Explain how you determined whether or not the datagram has been fragmented.

// mf = more fragments
uint16_t offset= ntoh16(iphdr->offset);
bool df= offset&IP_DF != 0;
bool mf= offset&IP_MF != 0;
offset &= IP_OFFMASK;
 
bool is_fragment= true;
if(mf)
{
	if(offset== 0) //first.
	{
	}
	else //middle.
	{
	}
}
else
{
	if(offset== 0) //complete.
	{
		is_fragment= false;
	}
	else //last
	{
	}
}

5. Which fields in the IP datagram always change from one datagram to the next within this series of ICMP messages sent by your computer?

6. Which fields stay constant? Which of the fields must stay constant? Which fields must change? Why?

stay constant : 
Version
Header Length
Differentiated Services Field
Flags
Protocol
Source Address
Destination Address 

must change:
Identification
Time to Live
Checksum

7. Describe the pattern you see in the values in the Identification field of the IP datagram.

因为IP是无可靠服务，报文不可以按序接收(TCP可以实现按序接收)。
但当报文长度超过MTU而必须分片时，这字段来标识多个分片是否属于同一个报文（同一个报文的标识符相同）。
该字段Flags和Fragment Offest 结合实现在接受端组合分片报文

8. What is the value in the Identification field and the TTL field?

9. Do these values remain unchanged for all of the ICMP TTL-exceeded replies sent to your computer by the nearest (first hop) router? Why?

不变。当这个IP封包通过一个路由器时，TTL才会减一。

10. Find the first ICMP Echo Request message that was sent by your computer after you changed the Packet Size in pingplotter to be 2000. Has that message been fragmented across more than one IP datagram?

信息将会被分片。
这是因为收集跟踪的计算机上有一个以太网卡将最大IP数据包的长度限制为1500个字节。

11. Print out the first fragment of the fragmented IP datagram. What information in the IP header indicates that the datagram been fragmented? What information in the IP header indicates whether this is the first fragment versus a latter fragment? How long is this IP datagram?

Flags:0x20   # 表明分片
Fragment Offset: 0	# 表明第一个分片
Total Length: 1500	# 表明总长度

12. Print out the second fragment of the fragmented IP datagram. What information in the IP header indicates that this is not the first datagram fragment? Are the more fragments? How can you tell?

Fragment Offset: 1480	# 表明不是第一个分片
由于包大小为2000bytes，一个分片最大为1500bytes，只能够分成两个片，故后面不会再有更多的分片。

13. What fields change in the IP header between the first and second fragment?

Fragment Offser & Header Checksum

14. How many fragments were created from the original datagram?

将会创造3个分片。

15. What fields change in the IP header among the fragments?

Header Checksum