WIRESHARK-ICMP Message Analysis

1. Test the machine, the source address IP is 10.21.28.110, the destination IP address is 10.6.0.24.

2. Use IP.SRC = = 10.6.0.24 or IP.DST = = 10.6.0.24 filter rules to show only the data that 10.21.28.110 and 10.6.0.24 interact with.

As shown, the ping command in Windows performs 4 ping programs by default, so Wireshark will catch 8 ICMP packets.

3. Observe the first Echo (ping) request data frame that is numbered 2066.

As shown, you can see the structure of this data frame is:

Ethernet II

Ip

Icmp

4. Observe the contents of the Ethernet II data frame.

The format of the Ethernet II data frame is as follows:

DA	Sa	Type
Data

DA: The field has 6 bytes, which represents the destination MAC address. As shown, the destination MAC address is 30:37:a6:f6:5a:4f.
SA: The field has 6 bytes, which represents the source MAC address. As shown, the source MAC address is 54:ee:75:25:33:fd.
Type: The field has 2 bytes, which represents the type of the packet. As shown, the type value is 0x0800, which represents Internet Protocol (IP).
Data: Payload.

5. Observe the contents of the IP packet.

As shown, you can see the information for the IP packet:

Version:4, representing IPv4.
Header Length:5, which represents 5 word, which is a three-bit unit, is the bytes.
Time to live:64, lifetime.
Protocol:1, which represents ICMP.
source:10.21.28.110, the source IP address.
destination:10.6.0.24, Destination IP address.

6. Observe the contents of the ICMP packet.

The format of the ICMP packet is as follows:

Type	Code	Checksum
Identifier		Seq Num
Data

Type: This field has 1 bytes representing a specific type of ICMP message.
Code: This field has 1 bytes, further subdividing the type of ICMP. As shown, the value of Type 8,code is 0, which indicates a echo request.
Checksum: This field has 2 bytes, indicating the checksum.
Identifier: This field has 2 bytes and is used to match the identifier of the request/reply.
Seq Num: This field has 2 bytes to match the serial number of the request/reply.
Data: Payload.

WIRESHARK-ICMP Message Analysis