Tags: ,

Forum Replies

  1. Hello Hussein!

    ICMP is a Layer 3 protocol. It actually never reaches Layer 4. So Wireshark doesn’t display any Layer 4 encapsulation because there is none.

    The encapsulation process starts at Layer 3, where source and destination IP addresses are assigned as usual, and gets encapsulated to layer 2 (where Ethernet, MAC addresses and PPP live to name a few) and then it is placed on the medium. Deencapsuation occurs at the destination up to layer three where the source and destination IP addresses are read. The ICMP protocol adds a header AFTER the IP header w

    ... Continue reading in our forum

  2. Hello Hussein.

    You are correct when you say that you cannot skip an OSI layer when communicating on the network. However, we can BEGIN our communication at layer 3 and go down to layer 1. In this case we are not skipping layers 4-7. Let me express this in an example:

    When you start an FTP file transfer from your computer, you are BEGINNING your communication at the Application layer, or layer 7. As you go down the OSI stack, you cannot skip layer 2 for example. MAC addresses must be placed in the L2 header and appropriate header information must be include

    ... Continue reading in our forum

  3. Hello again Rosna

    In traceroute, a probe is the number of ICMP echo requests sent to each individual hop. So if a traceroute has 7 hops to the destination, the Cisco device will send three probes, or three ICMP echo requests to each of the 7 hops for a total of 21 ICMP echo requests. If you select one probe, a single ICMP request will be sent to each hop. You won’t actually see a difference in the traceroute output.

    ... Continue reading in our forum

  4. Hi Liz, One last question on working of Traceroute. How the initial host (which generates icmp/ udp packets) knows that it has found the target? I mean what is special in a “Port Unreachable” message which makes it think that the packet has reached the destination. ( i. the corresponding port is not active on the destination ii. The packet is intended for it. Hence it sends port unreachable message, do I make sense???)

  5. Hello Eliu

    Your observation is well taken, and thank you for pointing that out. I should have been clearer in my explanation. You will notice that there is no UDP information in any of the captures that have to do with the ping command while you will see the UDP line as well added to that for any of the captures that have to do with traceroute. Ping does not include layer 4 however, traceroute incorporates layer four, specifically UDP in order to achieve its functionality.

    The default implementation of traceroute sends a sequence of UDP packets, with destina

    ... Continue reading in our forum

45 more replies! Ask a question or join the discussion by visiting our Community Forum