Scribd
Upload
139 views6 pages

Lab-7 1 6

This document summarizes the key details from packet captures showing ARP requests and replies, as well as ICMP echo requests and replies (pings). It identifies MAC addresses, IP addresses, frame types, and other technical details at each step. The document is divided into two parts, with the first part focusing on ARP and the second part focusing on ICMP echo requests between a PC and its default gateway and then to a remote host.

Uploaded by

Tiến Trung Nguyễn
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
Download as docx, pdf, or txt
139 views6 pages

Lab-7 1 6

This document summarizes the key details from packet captures showing ARP requests and replies, as well as ICMP echo requests and replies (pings). It identifies MAC addresses, IP addresses, frame types, and other technical details at each step. The document is divided into two parts, with the first part focusing on ARP and the second part focusing on ICMP echo requests between a PC and its default gateway and then to a remote host.

Uploaded by

Tiến Trung Nguyễn
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
Download as docx, pdf, or txt
Download as docx, pdf, or txt
You are on page 1/ 6

PART 1

Step 2:

Step 3:
This screenshot highlights the frame details for an ARP reply.

What is significant about the contents of the destination address field?

All hosts on the LAN will receive this broadcast frame. The host with the IP address of 192.168.99.1
(default gateway) will send a unicast reply to the source (PC host). This reply contains the MAC
address of the NIC of the default gateway.
Why does the PC send out a broadcast ARP prior to sending the first ping request?

The PC cannot send a ping request to a host until it determines the destination MAC address, so that
it can build the frame header for that ping request. The ARP broadcast is used to request the MAC
address of the host with the IP address contained in the ARP.

What is the MAC address of the source in the first frame?

it is b0:95:75:06:0a:a0.

What is the Vendor ID (OUI) of the Source NIC in the ARP reply?

it is HP

What portion of the MAC address is the OUI?

The first 3 octets of the MAC address indicate the OUI.

What is the NIC serial number of the source?


it is 79:07:46 in this case.

PART 2
Step 1:

What is the IP address of the PC default gateway?

192.168.99.1

Step 6:
What is the MAC address of the PC NIC?

it is 00:68:eb:79:07:46.

What is the default gateway’s MAC address?

it is b0:95:75:06:0a:a0.

What type of frame is displayed?

0x0800 or an IPv4 frame type.


What is the source IP address?

HP_79:07:46

What is the destination IP address?

Tp-LinkT_06:0a:a0

What do the last two highlighted octets spell?

Hi

What device and MAC address is displayed as the destination address?

b0:95:75:06:0a:a0.

Tp-LinkT_06:0a:a0

Step 7:

In the first echo (ping) request frame, what are the source and destination MAC addresses?

Source:

00:68:eb:79:07:46.

Destination:

b0:95:75:06:0a:a0.

What are the source and destination IP addresses contained in the data field of the frame?

Source:

192.168.99.115

Destination:

2001:ee0:3241:8088::b33:
Compare these addresses to the addresses you received in Step 6. The only address that changed is
the destination IP address. Why has the destination IP address changed, while the destination MAC
address remained the same?

Layer 2 frames never leave the LAN. When a ping is issued to a remote host, the source will use the
default gateway MAC address for the frame destination. The default gateway receives the packet,
strips the Layer 2 frame information from the packet and then creates a new frame header with the
MAC address of the next hop. This process continues from router to router until the packet reaches its
destination IP address.

Reflection question:
Wireshark does not display the preamble field of a frame header. What does the preamble contain?

The preamble field contains seven octets of alternating 1010 sequences, and one octet that
signals the beginning of the frame, 10101011.

You might also like