Wireshark Lab: IP

1. What is the IP address of your computer?

My ip address : 192.168.2.3

2. Within the IP packet header, what is the value in the upper layer protocol field?

Protocol: ICMP (1)

3. How many bytes are in the IP header? How many bytes are in the payload of the

IP datagram?  Explain how you determined the number of payload bytes.

Header length: 20 bytes
Payload = Total Length: 56 – header length:20 = 36 bytes.

4. Has this IP datagram been fragmented?  Explain how you determined whether or
not the datagram has been fragmented.

This IP datagram has not been fragmented. I know this because the more fragments bit has not been set.


5. Which fields in the IP datagram always change from one datagram to the next
within this series of ICMP messages sent by your computer?

The checksum always changes and so does the sequence number


6. Which fields stay constant?  Which of the fields must stay constant? Which fields
must change?  Why?

Header length and time to live stay constant because these are preset. The fragment number, sequence number, flags, total length and checksum very from each segment so they change.


7. Describe the pattern you see in the values in the Identification field of the IP datagram.

The value of the identification field is incremented by 1 on every new outgoing message.

8. What is the value in the Identification field and the TTL field?

Identification: 0x93b7 (37815)
Time to live: 248



9. Do these values remain unchanged for all of the ICMP TTL-exceeded replies sent
to your computer by the nearest (first hop) router?  Why?

The identification field changes in the ICMP TTL-exceeded replies for it needs to be unique. The time to live remains the same as it is a constant.



10. Find the first ICMP Echo Request message that was sent by your computer after
you changed the Packet Size in pingplotter to be 2000. Has that message been
fragmented across more than one IP datagram?  

Yes, it has been fragmented.


11. Print out the first fragment of the fragmented IP datagram. What information in
the IP header indicates that the datagram been fragmented?  What information in
the IP header indicates whether this is the first fragment versus a latter fragment?  
How long is this IP datagram

The more fragments bit is set to 1 indicates that the datagram has been fragmented.
Since the fragment offset is set to 0 this indicates that this is the first fragment.
The datagram’s length is set to 1500


12. Print out the second fragment of the fragmented IP datagram. What information in
the IP header indicates that this is not the first datagram fragment?  Are the more
fragments?  How can you tell?

Since fragment offset is set to 1480 this shows that it is not the first fragment.
Since the more fragments bit is set to zero this indicates there are no more fragments.











13. What fields change in the IP header between the first and second fragment?

The fields that change are the flags, header checksum, total length and fragment offset



14. How many fragments were created from the original datagram?  

Three fragments were created from the original datagram.

15. What fields change in the IP header among the fragments

Fragment offset, total length, more fragments bit, TTL and the checksum