Wireshark Lab: IP

Worked with Thomas Vear.

1.  216.92.151.75
2. The value of the header is ICMP
3.  Because there are 56 bytes total, 20 of the bytes go to the IP header, and the other 36 are from the IP datagram.
4. The data is not fragmented because the fragment line = 0.

5.  Time to live, Identification, and the header always change.
6. MUST STAY CONSTANT:  header length, version, source IP, desination IP, upper layer protocol, services
MUST CHANGE: identification, header checksum, time to live.
7. The IP header fields change incremently with each change in field.
8. Identification: 60500
Time to live: 254
9. The identification field will change for all of the ICMP time to live requests, but they will not change with a hop router because they are using the same router.

10. Yes, more than one IP datagram was used.
11. The fragment offset is = 0, therefore this is the first fragment. The length is 1500 bytes.
12. It isnt the first fragment, because the offset is not 0.
13. The changes are offset, checksum, flags, total length.
14. 3 packets are created.
15. The fragment offset and checksum will change.