IP协议分析

IP 协议分析

the first ICMP Echo Request message sent by your computer, and expand

the Internet Protocol part of the packet in the packet details is the IP address of your computer

2. Within the IP packet header, what is the value in the upper layer protocol field

上层协议区域的值为ICMP（1）

3. How many bytes are in the IP header How many bytes are in the payload of the

IP datagram Explain how you determined the number of payload bytes.

4. Has this IP datagram been fragmented Explain how you determined whether or

not the datagram has been fragmented

该数据包没有被分割，在Flags 标记中，More fragments 被置为0，所以，说明后面没有被分段。

5. Which fields in the IP datagram always change from one datagram to the next

within this series of ICMP messages sent by your computer

能

6. Which fields stay constant Which of the fields must stay constant Which fields

must change Why

必须改变的：Identification(标识)、Header checksum(头部检验和)

标识是源主机赋予IP数据报的标识符、头部校验和用于保证IP数据报报头的完整性。

必须保持不变的：Version(版本)、Header length(头部长度)、Differentiated Services Field(区分服务)、Flags(标记)、Fragment offset(片偏移)、Protocol(协议)、Destination(目地地址)

7. Describe the pattern you see in the values in the Identification field of the IP Datagram

Next (with the packets still sorted by source address) find the series of ICMP TTLexceeded replies sent to your computer by the nearest (first hop) router.

8. What is the value in the Identification field and the TTL field

9. Do these values remain unchanged for all of the ICMP TTL-exceeded replies sent

to your computer by the nearest (first hop) router Why

由上图可知，TTL值不变。

10. Find the first ICMP Echo Request message that was sent by your computer after

you changed the Packet Size in pingplotter to be 2000. Has that message been

fragmented across more than one IP datagram [Note: if you find your packet has

not been fragmented, you should download the zip file

and extract the ipethereal-

trace-1packet trace. If your computer has an Ethernet interface, a packet

size of 2000 should cause ]

该消息传送多于一个IP数据包的分段，More fragment被置为1；Fragment offset：0，说明为第一个片段；Total length:1500。第二个片段Total length:548, 两个片段总长度相加为2048 bytes，减去IP头部20 bytes，等于2028 bytes。

11. Print out the first fragment of the fragmented IP datagram. What information in

the IP header indicates that the datagram been fragmented What information in

the IP header indicates whether this is the first fragment versus a latter fragment

How long is this IP datagram

Fragment offset：1480，说明不是第一个片段；More fragment被置为0，说明没有更多片段；

头部有20字节，总共有548字节，该IP 的数据包是548 – 20 =528 字节。

12. Print out the second fragment of the fragmented IP datagram. What information in

the IP header indicates that this is not the first datagram fragment Are the more

fragments How can you tell

Fragment offset：1480，说明不是第一个片段；More fragment被置为0，说明没有更多片段

13. What fields change in the IP header between the first and second fragment

Total length、Flags中的More fragment、Fragment offset、Header checksum改变

Now find the first ICMP Echo Request message that was sent by your computer after you changed the Packet Size in pingplotter to be 3500.

14. How many fragments were created from the original datagram

从原始数据包中，产生了两个分段，片偏移分别为：0 , 1480 。