# Lab 6

## Lab 6-1
**Select the first ICMP Echo Request message sent by your computer, and expand the Internet Protocol part of the packet in the packet details window. What is the IP address of your computer?**

Ans: 192.168.0.1

## Lab 6-2
**Within the IP packet header, what is the value in the upper layer protocol field?**

Ans: ICMP(1)
## Lab 6-3
**How many bytes are in the IP header? How many bytes are in the payload of the IP datagram? Explain how you determined the number of payload bytes.**

Ans: 20 bytes in IP header, 56 bytes total length, 36 bytes in payload of the IP datagram
## Lab 6-4
**Has this IP datagram been fragmented? Explain how you determined whether or not the datagram has been fragmented**

Ans: the more fragments bit is not set so the data is not fragmented

## Lab 6-5
**Which fields in the IP datagram always change from one datagram to the next within this series of ICMP messages sent by your computer**

Ans: Identification, TTL, Header checksum

## Lab 6-6
**Which fields stay constant? Which of the fields must stay constant? Which fields must change? Why?**

:::info
1. Stay constant
- version(IPv4)
- header length(ICMP packets)
- source IP
- destination IP
- Differentiated Service (all packet use ICMP)
- Upper Layer Protocol(ICMP packets)
2. Change
- Identification(IP packets must have defferent IDs)
- Time to live(traceroute increments each subsequent packet)
- Header Checksum(since header changes, so must checksum)
:::

## Lab 6-7
**Describe the pattern you see in the values in the Identification field of the IP datagram**

:::info
IP header Identification fields increment with wach ICMP Echo request
:::
## Lab 6-8
**What is the value in the Identification field and the TTL field?**

:::info
- Identification: 0x8437
- TTL: 56

:::

## Lab 6-9
**Do these values remain unchanged for all of the ICMP TTL-exceeded replies sent to your computer by the nearest (first hop) router? Why?**

:::info
- Identification field changes for all of the ICMP TTL-exceeded replies. Because identification field is unique. If two of the IP datagram are same as identification field. It means that datagrams are fragments of the single large IP datagram.
- TTL field is unchanged, because the TTL for the first hop router is always the same.
:::

## Lab 6-10
**Find the first ICMP Echo Request message that was sent by your computer after you changed the Packet Size in pingplotter to be 2000. Has that message been fragmented across more than one IP datagram?**

:::info
Ans: Yes
:::

## Lab 6-11
**Print out the first fragment of the fragmented IP datagram. What information in the IP header indicates that the datagram been fragmented? What information in the IP header indicates whether this is the first fragment versus a latter fragment? How long is this IP datagram?**

:::info
- more fragment column is 1
- fragment offset is 0
:::

## Lab 6-12

**Print out the second fragment of the fragmented IP datagram. What information in the IP header indicates that this is not the first datagram fragment? Are the more fragments?
How can you tell?**

:::info
The fragment offset is not zero and no more fragment
:::

## Lab 6-13
**What fields change in the IP header between the first and second fragment?**

:::info
As above, there are total length, the more fragment field, fragment offset, checksum
:::