IP协议分析

IP协议分析上层协议区域的值为ICMP（1）3.HowmanybytesareintheIPheader?HowmanybytesareinthepayloadoftheIPdatagram?Explainhowyoudeterminedthenumberofpayloadbytes.4.HasthisIPdatagrambeenfragmented?Explainhowyoudeterminedwhetherornotthedatagramhasbeenfragmented该数据包没有被分割，在Flags标记中，Morefragments被置为0，所以，说明后面没有被分段。5.WhichfieldsintheIPdatagramalwayschangefromonedatagramtothenextwithinthisseriesofICMPmessagessentbyyourcomputer?电脑IP地址头部有20字节，总共有84字节，该数据包的有效载荷是84-20=64字节能6.Whichfieldsstayconstant?Whichofthefieldsmuststayconstant?Whichfieldsmustchange?Why?必须改变的：Identification(标识)、Headerchecksum(头部检验和)标识是源主机赋予IP数据报的标识符、头部校验和用于保证IP数据报报头的完整性。必须保持不变的：Version(版本)、Headerlength(头部长度)、DifferentiatedServicesField(区分服务)、Flags(标记)、Fragmentoffset(片偏移)、Protocol(协议)、Destination(目地地址)7.DescribethepatternyouseeinthevaluesintheIdentificationfieldoftheIPDatagramNext(withthepacketsstillsortedbysourceaddress)findtheseriesofICMPTTLexceededrepliessenttoyourcomputerbythenearest(firsthop)router.8.WhatisthevalueintheIdentificationfieldandtheTTLfield?Identification字段TTL字段的值9.DothesevaluesremainunchangedforalloftheICMPTTL-exceededrepliessenttoyourcomputerbythenearest(firsthop)router?Why?由上图可知，TTL值不变。10.FindthefirstICMPEchoRequestmessagethatwassentbyyourcomputerafteryouchangedthePacketSizeinpingplottertobe2000.HasthatmessagebeenfragmentedacrossmorethanoneIPdatagram?[Note:ifyoufindyourpackethasnotbeenfragmented,youshoulddownloadthezipfile]TTL字段的值TTL字段的值Identification字段Identification字段该消息传送多于一个IP数据包的分段，Morefragment被置为1；Fragmentoffset：0，说明为第一个片段；Totallength:1500。第二个片段Totallength:548,两个片段总长度相加为2048bytes，减去IP头部20bytes，等于2028bytes。11.PrintoutthefirstfragmentofthefragmentedIPdatagram.WhatinformationintheIPheaderindicatesthatthedatagrambeenfragmented?WhatinformationintheIPheaderindicateswhetherthisisthefirstfragmentversusalatterfragment?HowlongisthisIPdatagram?Fragmentoffset：1480，说明不是第一个片段；Morefragment被置为0，说明没有更多片段；头部有20字节，总共有548字节，该IP的数据包是548–20=528字节。12.PrintoutthesecondfragmentofthefragmentedIPdatagram.WhatinformationintheIPheaderindicatesthatthisisnotthefirstdatagramfragment?Arethemorefragments?Howcanyoutell?Fragmentoffset：1480，说明不是第一个片段；Morefragment被置为0，说明没有更多片段13.WhatfieldschangeintheIPheaderbetweenthefirstandsecondfragment?Totallength、Flags中的Morefragment、Fragmentoffset、Headerchecksum改变NowfindthefirstICMPEchoRequestmessagethatwassentbyyourcomputerafteryouchangedthePacketSizeinpingplottertobe3500.14.Howmanyfragmentswerecreatedfromtheoriginaldatagram?从原始数据包中，产生了两个分段，片偏移分别为：0,1480。15.WhatfieldschangeintheIPheaderamongthefragments?Totallength、Flags中的Morefragment、Fragmentoffset、Headerchecksum改变