Lab 9 : Basic Routing, ARP, ICMP, and Wireshark Demo
with GNS3 Tool
1. Introduction to GNS3
● Definition: Graphical Network Simulator that allows designing, testing, and troubleshooting
complex networks.
● Purpose: Simulate routers, switches, firewalls, and network topologies before real deployment.
● Advantages:
○ No need for physical devices.
○ Integration with real devices and Wireshark.
○ Visual and interactive network design.
2. Basic Routing
● Definition: The process of forwarding packets between networks based on IP addresses.
● Types of Routing:
○ Static Routing: Manually configured routes.
○ Dynamic Routing: Routes learned automatically (e.g., RIP, OSPF, EIGRP).
● Routing Table: Contains destination networks, next-hop addresses, and interfaces.
Demo (GNS3):
1. Connect two or more routers.
2. Configure interfaces with IP addresses.
3. Add static routes:
Router(config)# ip route [Link] [Link] [Link]
4. Test connectivity using ping.
3. ARP (Address Resolution Protocol)
● Purpose: Maps IP addresses to MAC addresses.
● Function:
○ When a device wants to send data to another IP in the same network, it sends an ARP
request.
○ The target device responds with its MAC address.
🧠 Key Point: ARP operates at Layer 2 (Data Link) and links to Layer 3 (Network).
Demo in GNS3 + Wireshark:
Use ping between hosts.
Capture ARP packets in Wireshark:
○ ARP Request: “Who has [Link]?”
○ ARP Reply: “[Link] is at 00:0c:29:ab:cd:ef”
4. ICMP (Internet Control Message Protocol)
● Purpose: Used for diagnostic and error messages (e.g., Ping, Traceroute).
● Common ICMP Messages:
○ Echo Request / Echo Reply (Ping)
○ Destination Unreachable
○ Time Exceeded
Wireshark Capture:
● Observe ICMP Echo Request and Echo Reply.
● Check TTL (Time To Live) values.
5. Wireshark Demo
Install GNS3 and Wireshark
● Install GNS3 All-in-One for easy setup.
● During Wireshark installation, make sure to check the option to install Npcap (required for
capturing packets).
Configure GNS3 to Use Wireshark
Open GNS3 → Edit → Preferences
A. Configure Wireshark Path
1. Go to: Edit → Preferences → Packet Capture
2. Under "Path to Wireshark executable", click "Browse"
3. Navigate to your Wireshark installation folder and select:
○ On Windows: [Link]
Default path: C:\Program Files\Wireshark\[Link]
○ On macOS/Linux: /usr/bin/wireshark (ensure it's installed via terminal)
4. Click Apply and OK.
B. install Cisco ISO routers from internet ( we uploaded this files on Blackboard )
1. Go to: Edit → Preferences → ISO Routers
2. New → add file path → next → …..→ ok → apply → ok
Create a Basic Topology in GNS3
1. Drag and drop a router or switch into the workspace.
2. Connect devices using appropriate links (e.g., Ethernet).
3. Start all devices and wait until they boot up.
Start Packet Captures Using Wireshark
Capture from Link Between Devices
1. Right-click on the link between two devices.
2. Select "Capture" → Choose the interface if prompted.
3. GNS3 will start capturing traffic and automatically open Wireshark with live data.
Using Wireshark for Analysis
Once Wireshark opens:
● You can apply filters like:
○ arp
○ icmp
○ [Link] == 192.168.x.x
● Analyze protocols, headers, conversations, and more
6. Summary
Concept Function OSI Layer Example Command
Routing Packet forwarding between networks Layer 3 ip route
ARP IP–MAC address mapping Layer 2 show arp
ICMP Diagnostics and error reporting Layer 3 ping, traceroute
Wireshark Packet capture and analysis N/A (All Layers) GUI tool
7. Conclusion
● GNS3 enables practical network design and testing.
● ARP, ICMP, and routing are foundational for network communication.
● Wireshark helps visualize and understand network traffic behavior.
………………………………………………………………………………………………………
……………………………..
8. Lab Work :
1. Open GNS3 design the network like in the picture .
2. Configure all devices as shown below .
3. Test the connectivity by using the Ping command.
4. Clear all arp cache on all devices .
5. Start capturing the routing from wershark
Config PC1:
PC1> ip [Link] [Link] 24
Checking for duplicate address...
PC1 : [Link] [Link] gateway [Link]
Config R1:
R1#
R1#conf t
R1(config)#int f0/0
R1(config-if)#ip add [Link] [Link]
R1(config-if)#no shutdown
R1(config-if)#
*Mar 1 00:05:18.343: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
*Mar 1 00:05:19.343: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0,
changed state to up
R1(config-if)#int f0/1
R1(config-if)#ip add [Link] [Link]
R1(config-if)#no shutdown
R1(config-if)#end
R1#show ip interface brief
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 [Link] YES manual up up
FastEthernet0/1 [Link] YES manual up up
R1#conf t
R1(config)#ip route [Link] [Link] [Link]
R1(config)#end
R1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
[Link]/24 is subnetted, 1 subnets
S [Link] [1/0] via [Link]
[Link]/24 is subnetted, 1 subnets
C [Link] is directly connected, FastEthernet0/1
C [Link]/24 is directly connected, FastEthernet0/0
R1#$[Link] 10.0.1.2ip route [Link] [Link] [Link]
ip route [Link] [Link] 10.0.1.2ip route [Link] [Link] 10 ^.0.1.2
% Invalid input detected at '^' marker.
Config PC2:
PC2> ip [Link] [Link] 24
Checking for duplicate address...
PC1 : [Link] [Link] gateway [Link]
PC2> show
NAME IP/MASK GATEWAY MAC LPORT RHOST:PORT
PC2 [Link]/24 [Link] 00:50:79:66:68:01 10020 [Link]:10021
fe80::250:79ff:fe66:6801/64
Config R2:
R2#conf t
R2(config)#int f0/1
R2(config-if)#ip add [Link] [Link]
R2(config-if)#no shutdown
R2(config)#int f0/0
R2(config-if)#ip add [Link] [Link]
R2(config-if)#no shutdown
R2(config-if)#end
R2#show ip interface brief
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 [Link] YES manual up up
FastEthernet0/1 [Link] YES manual up up
R2(config)#ip route [Link] [Link] [Link]
R2(config)#end
R2#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
[Link]/24 is subnetted, 1 subnets
C [Link] is directly connected, FastEthernet0/1
[Link]/24 is subnetted, 1 subnets
C [Link] is directly connected, FastEthernet0/0
S [Link]/24 [1/0] via [Link]
To test the routing connections:
R2#ping [Link]
R2#ping [Link]
R1#ping [Link]
PC1> ping [Link]
PC2> ping [Link]
If all testing routing succeed now start capturing the routing by wireshark
First clear arp cash from all devices
PC1 & PC2 write command ( clear arp )
R1 & R2 write command ( clear arp-cash)
9) Capture with Wireshark
1. In GNS3 right-click the link between R1 and R2 → Start capture.
2. Wireshark opens. Apply filters to inspect:
○ arp — view ARP requests/replies
○ icmp — view echo request/reply
○ [Link]==[Link] && [Link]==[Link] — track PC1→PC2 traffic
3. Observe ICMP echo requests going from PC1 → R1 → R2 → PC2 and replies back.
4. Analyze the static routing from these filters .