CloudLabBox
Try the free demo

Packet analysis lab 4 of 12

IPv4 and IPv6 headers: TTL and fragments with ICMP and neighbour discovery

Read the IP layer like an analyst. You work out how far away a host is from its TTL, watch traceroute's ICMP errors and the packets they quote, take a large ping apart into fragments (and see a router fragment them again), catch path-MTU discovery in the act, and follow IPv6 router and neighbour discovery.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 3,072 MB in total. That fits the free demo too.

In your workspace: Shared, then Packet analysis with Wireshark and tcpdump guided labs, then 04 - IPv4 and IPv6 headers - TTL and fragments with ICMP and neighbour discovery

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 70 minutes
Nodes need
5 vCPU, 3,072 MB
Smallest plan
Lite

The scenario

Fellside Outdoor's office PC PC1 reaches the warehouse server SRV through two routers. The link between them is a cheap tunnel service with a 1400-byte MTU, and some file transfers have been "hanging" since it was installed. Before you chase that, you'll learn what the IP layer itself tells you in a capture. Your workstation WS is a tap between PC1 and R1, so you see everything PC1 sends and receives.

DeviceInterfaceIPv4IPv6
PC1eth010.50.1.21/24, gateway .1SLAAC in 2001:db8:50:1::/64
R1Gi0/010.50.1.1/242001:db8:50:1::1/64, link-local fe80::1
R1Gi0/1 (MTU 1400)10.50.12.1/302001:db8:50:12::1/64
R2Gi0/1 (MTU 1400)10.50.12.2/302001:db8:50:12::2/64
R2Gi0/010.50.2.1/242001:db8:50:2::1/64, link-local fe80::2
SRVeth010.50.2.10/24, gateway .12001:db8:50:2::10/64
WSbr0 (eth0 + eth1)nonenone (it's a tap)

Your workstation, WS. Open WS's console (a remote desktop, root / eve) and start Wireshark from Applications > Internet > Wireshark. Capture on eth0, the PC1 side of the tap. Write answers in /root/answers.txt (pluma /root/answers.txt &).

What you’ll practise

  • Read the IPv4 header fields: TTL, identification, flags, fragment offset, total length and protocol
  • Predict the number of router hops from a TTL and an operating system's initial TTL
  • Explain ICMP types and codes and find the original packet quoted inside an ICMP error
  • Follow fragmentation and path-MTU discovery in a capture
  • Identify IPv6 link-local, global and multicast addresses and read router and neighbour discovery messages

The tasks

  1. Address the hosts
  2. TTL and distance
  3. Traceroute and the packet inside the error
  4. Fragmentation
  5. Path-MTU discovery
  6. IPv6 router and neighbour discovery

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of IPv4 and IPv6 headers - TTL and fragments with ICMP and neighbour discovery5 nodes, 4 links. Every link is listed as text below the diagram.PC1WSR1R2SRVeth0eth0eth1Gi0/0Gi0/1Gi0/1Gi0/0eth0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • PC1 eth0 to WS eth0
  • WS eth1 to R1 Gi0/0
  • R1 Gi0/1 to R2 Gi0/1
  • R2 Gi0/0 to SRV eth0
Nodes in IPv4 and IPv6 headers: TTL and fragments with ICMP and neighbour discovery, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
PC1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
WSEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
R1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
R2Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
SRVAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Packet analysis with Wireshark and tcpdump guided labs.

  3. Open 04 - IPv4 and IPv6 headers - TTL and fragments with ICMP and neighbour discovery and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Packet analysis labs

All Packet analysis labs

Related labs in other courses

CloudLabBox is independent of the Wireshark Foundation, CompTIA and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.