Mehran University of Engineering and Technology, Jamshoro
Masters of Science in Cyber Security
Secure Networks and Protocols (1st Semester, 1st Year)
Name: Touheed Ahmed Roll Number: 26MSCYS004
Score: Signature: Date:
LAB HANDOUTS # 05
IP PROTOCOL ANALYSIS
Objectives:
The primary objective of this lab is to analyze the IP protocol using Wireshark. By the end of
this lab, you will:
Understand the structure of IP datagrams, including the fields in the IP header.
Investigate IP fragmentation and how large datagrams are divided into smaller fragments
for transmission.
Observe the behavior of IP during the execution of the traceroute program.
Analyze the interaction between IP and ICMP (Internet Control Message Protocol) in
generating TTL-exceeded messages.
Lab Deliverables:
Lab Report: Submit a lab report that includes the answers to all the questions.
Screenshots: Include screenshots of the Wireshark interface showing the captured
IP datagrams, including fragmented packets.
Analysis: Provide a detailed analysis of the IP datagram fields, fragmentation, and the
interaction between IP and ICMP.
Theory:
What is IP?
The Internet Protocol (IP) is a connectionless protocol that provides the addressing and routing
functions necessary for data to travel across networks. IP is responsible for delivering packets
from the source host to the destination host based on IP addresses. It operates at the network
layer of the OSI model and is a core protocol of the Internet protocol suite.
Key Features of DNS:
Addressing: IP uses IP addresses (e.g., [Link]) to identify devices on a network.
Routing: IP determines the best path for data to travel from the source to the destination.
Fragmentation: IP can fragment large datagrams into smaller packets to accommodate the
Maximum Transmission Unit (MTU) of the underlying network.
Time-to-Live (TTL): IP uses the TTL field to prevent packets from circulating
indefinitely in the network.
Mehran University of Engineering and Technology, Jamshoro
Masters of Science in Cyber Security
Secure Networks and Protocols (1st Semester, 1st Year)
Lab Instructions
Step 1: Capturing Packets from Traceroute
Start Wireshark: Open Wireshark and begin packet capture by selecting Capture ->
Options.
Run Traceroute:
o Windows: Use pingplotter to perform a traceroute. Set the packet size to 56 bytes,
2000 bytes, and 3500 bytes.
o Linux/Unix: Use the traceroute command with packet sizes of 56 bytes, 2000
bytes, and 3500 bytes.
If you are using a Windows platform, start up pingplotter and enter the name of a target
destination in the “Address to Trace Window.” Enter 3 in the “# of times to Trace” field,
so you don’t gather too much data. Select the menu item Edit- >Advanced Options-
>Packet Options and enter a value of 56 in the Packet Size field and then press OK. Then
press the Trace button. You should see a pingplotter window that looks something like
this:
Next, send a set of datagrams with a longer length, by selecting Edit->Advanced Options-
>Packet Options and enter a value of 2000 in the Packet Size field and then press OK.
Then press the Resume button.
Finally, send a set of datagrams with a longer length, by selecting Edit->Advanced
Options->Packet Options and enter a value of 3500 in the Packet Size field and then press
OK. Then press the Resume button
Mehran University of Engineering and Technology, Jamshoro
Masters of Science in Cyber Security
Secure Networks and Protocols (1st Semester, 1st Year)
Stop Wireshark: After capturing the traceroute packets, stop Wireshark packet capture.
Step 2: Analyzing IP Datagram Fields
Sort Packets by Source Address: In Wireshark, sort the packets by IP source address by
clicking on the Source column header.
Examine ICMP Echo Request Messages: Select the first ICMP Echo Request message
sent by your computer and expand the Internet Protocol section in the packet details
window.
Step 3: Analyzing ICMP TTL-Exceeded Messages
Find ICMP TTL-Exceeded Replies: Locate the series of ICMP TTL-exceeded replies
sent to your computer by the nearest (first hop) router.
Examine IP Header Fields: Expand the Internet Protocol section in the packet details
window for these ICMP messages
.
Mehran University of Engineering and Technology, Jamshoro
Masters of Science in Cyber Security
Secure Networks and Protocols (1st Semester, 1st Year)
Step 4: Investigating IP Fragmentation
Sort Packets by Time: In Wireshark, sort the packets by time by clicking on the Time
column.
Find Fragmented Datagrams: Locate the first ICMP Echo Request message sent after
changing the packet size to 2000 bytes. Determine if the message has been fragmented.
Step 5: Analyzing Large Datagram Fragmentation
Find Large Datagram Fragments: Locate the first ICMP Echo Request message sent after
changing the packet size to 3500 bytes.
Examine Fragmentation: Determine how many fragments were created from the original
datagram.
Questions to Answer:
1. What is the IP address of your computer?
Source IP Address: [Link]
2. Within the IP packet header, what is the value in the upper-layer protocol field?
Protocol: ICMP (1)
3. How many bytes are in the IP header? How many bytes are in the payload of the IP
Mehran University of Engineering and Technology, Jamshoro
Masters of Science in Cyber Security
Secure Networks and Protocols (1st Semester, 1st Year)
datagram? Explain how you determined the number of payload bytes.
Header Length = 20 bytes
Total Length = 56 bytes
Payload = Total Length – Header Length
Payload = 56 – 20 = 36 bytes
4. Has this IP datagram been fragmented? Explain how you determined whether or not the
datagram has been fragmented.
Ans: The More fragment and fragment offset is 0 so the data is not been fragmented.
Mehran University of Engineering and Technology, Jamshoro
Masters of Science in Cyber Security
Secure Networks and Protocols (1st Semester, 1st Year)
5. Which fields in the IP datagram always change from one datagram to the next within this
series of ICMP messages sent by your computer?
Identification: Increments for each new packet sent.
Header Checksum: Recalculated because the Identification and TTL fields change.
Time to Live (TTL): In a traceroute, this increments (1, 2, 3...) to reach further hops.
6. Which fields stay constant? Which of the fields must stay constant? Which fields must
change? Why?
Must Stay Constant: Version (4), Header Length (usually 20), Source IP, Destination IP, Protocol
(1). These define the source, destination, and type of traffic.
Must Change: Identification (to distinguish packets) and Checksum (to ensure integrity after other
fields change).
7. Describe the pattern you see in the values in the Identification field of the IP datagram.
Ans: The Identification field usually follows a sequential/incremental pattern (17330, 17331, 17332).
This helps the destination reassemble fragments if necessary.
8. What is the value in the Identification field and the TTL field?
Ans: Identification: 17330, TTL: 128
9. Do these values remain unchanged for all of the ICMP TTL-exceeded replies sent to your
computer by the nearest (first hop) router? Why?
Identification: Changes for every reply (every packet needs a unique ID).
TTL: Usually remains unchanged for all replies from the same router, as the router always starts its
outgoing packets with the same default TTL value.
10. Has the message been fragmented across more than one IP datagram?
Yes. Since the standard Ethernet MTU (Maximum Transmission Unit) is 1500 bytes, a 2000-byte packet
(plus headers) exceeds this limit and must be split.
Mehran University of Engineering and Technology, Jamshoro
Masters of Science in Cyber Security
Secure Networks and Protocols (1st Semester, 1st Year)
11. Print out the first fragment of the fragmented IP datagram. What information in the IP
header indicates that the datagram has been fragmented? What information indicates
whether this is the first fragment versus a latter fragment? How long is this IP datagram?
Header Indicators: The More Fragments (MF) bit is set to 1, and the Fragment Offset is 0.
Length: The Total Length of the first fragment is typically 1500 bytes (20 bytes header + 1480 bytes
data).
12. Print out the second fragment of the fragmented IP datagram. What information in the IP
header indicates that this is not the first datagram fragment? Are there more fragments?
How can you tell?
Header Indicators: The Fragment Offset will be greater than 0 (usually 1480).
Are there more? If the More Fragments (MF) bit is 0, it is the last fragment.
Length: The length will be the remainder (Original Total Length - 1480).
13. What fields change in the IP header between the first and second fragment?
Total Length: The fragments are usually different sizes.
Flags: The MF bit is 1 for the first and 0 for the last.
Fragment Offset: 0 for the first, 1480 for the second.
Checksum: Changes because the fields above changed.
Note: The Identification field stays the same for all fragments of the one original packet.
Mehran University of Engineering and Technology, Jamshoro
Masters of Science in Cyber Security
Secure Networks and Protocols (1st Semester, 1st Year)
14. How many fragments were created from the original datagram?
For a 3500-byte payload:
1. Fragment 1: 1480 bytes data (Total 1500).
2. Fragment 2: 1480 bytes data (Total 1500).
3. Fragment 3: 540 bytes data (Total 560). Total: 3 fragments.
15. What fields change in the IP header among the fragments?
The Fragment Offset, Flags (MF bit), Total Length, and Header Checksum changed across the three
fragments. The Identification value remains identical across all three to allow computer to reassemble
them into the single 3500-byte message.