I used the command ping l 300 134 71 177 148 and then captured some frames with Wireshark (a) Some of my frames look like this Which shows a length of 342 bytes of ping l 300 and also in the middle panel and bottom panel, you can see Here 0x148 in bytes 16 and 17 is equal to decimal 256 4 16 8 328 So you see that with ping l 300, you get 328 decimal ( 0x0148) in IP header, but 342 bytes as interpreted by Wireshark Why 300 appears as 328 in IP header and 342 in the frame line (top panel) and also middle panel Explain (b)Based on this, deduce the minimum ICMP frame length that you can see in Wireshark What will be in bytes 16 and 17 or IP total length field (c) Can you run ping l 70000 134 71 177 148 Why (d) Now run ping l 3000 134 71 177 148 (number after l is 3,000, or three thousands) What do you see in Wireshark Based on the same reasoning as in Q1, do you expect total length to be 3,028 in decimal and Wireshark says the length is 3,042 If not, why Explain (e) Is it possible to have IP frame with 3 or more fragments If so, what ping command would you use (hint use ping l 134 71 177 148, where is a number picked by you) Fragmentation is explained in the following slide 136 192 168 1 18 2 134 71 177 14B 28 12 263477 134 71 177 148 192 168 1 10 342 Echo (ping) request id 0x32B1, seq 41 1B4g6, tt 1 12B reply in 28) CMP ICMP 342 Echo (ping) reply id 0x0001 seq 41 10496, ttl 240 (request in 27

The Answer is in the image, click to view ...

Answered step by step

Verified Expert Solution

Link Copied!

Question

1 Approved Answer

Posted on Sep 24, 2024

I used the command ping l 300 134.71.177.148 and then captured some frames with Wireshark. (a) Some of my frames look like this: Which shows

I used the command "ping l 300 134.71.177.148" and then captured some frames with Wireshark.

(a) Some of my frames look like this: image text in transcribed Which shows a length of 342 bytes of ping l 300 and also in the middle panel and bottom panel, you can see

Here 0x148 in bytes 16 and 17 is equal to decimal 256 + 4*16 + 8 = 328.

So you see that with ping l 300, you get 328 decimal (=0x0148) in IP header, but 342 bytes as interpreted by Wireshark. Why 300 appears as 328 in IP header and 342 in the frame line (top panel) and also middle panel? Explain!

(b)Based on this, deduce the minimum ICMP frame length that you can see in Wireshark. What will be in bytes 16 and 17 or IP total length field?

(d) Now run ping l 3000 134.71.177.148 (number after l is 3,000, or three thousands). What do you see in Wireshark. Based on the same reasoning as in Q1, do you expect total length to be 3,028 in decimal and Wireshark says the length is 3,042? If not, why? Explain.

(e) Is it possible to have IP frame with 3 or more fragments? If so, what ping command would you use? (hint: use ping l 134.71.177.148, where is a number picked by you). Fragmentation is explained in the following slide: image text in transcribed

136 192.168.1.18 2 134.71.177 14B 28 12.263477 134.71.177.148 192.168.1.10 342 Echo (ping) request id-0x32B1, seq 41/1B4g6, tt 1-12B reply in 28) CMP ICMP 342 Echo (ping) reply id 0x0001. seq 41/10496, ttl 240 (request in 27