Wireshark/ICMP Time Exceeded

Wireshark is a free and open source packet analyzer used for network troubleshooting and analysis. These activities will show you how to use Wireshark to capture and analyze Internet Control Message Protocol (ICMP) Time Exceeded traffic.

Readings

• Wikipedia: Internet Control Message Protocol

Preparation

To prepare for this activity:

1. Start Windows.
2. Log in if necessary.
3. Install Wireshark.

Activity 1 - Capture ICMP Time Exceeded Traffic

To capture ICMP Time Exceeded traffic:

1. Start a Wireshark capture.
2. Use ping -i 1 8.8.8.8 to ping one of Google's public DNS servers with a Time To Live setting of 1.
3. Stop the Wireshark capture.

Activity 2 - Analyze ICMP Echo Request Traffic

To analyze ICMP Echo Request traffic:

1. Observe the traffic captured in the top Wireshark packet list pane. Look for traffic with ICMP listed as the protocol. To view only ICMP traffic, type icmp (lower case) in the Filter box and press Enter.
2. Select the first ICMP packet, labeled Echo (ping) request.
3. Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 4 / Internet Control Message Protocol frame.
4. Expand Internet Protocol Version 4 to view IPv4 details.
5. Observe the Time to live. Notice that the time to live is set to 1.
6. Expand Internet Control Message Protocol to view ICMP details.
7. Observe the Type. Notice that the type is 8 (Echo (ping) request).
8. Select Data in the middle Wireshark packet details pane to highlight the data portion of the frame.
9. Observe the packet contents in the bottom Wireshark packet bytes pane. Notice that Windows sends an alphabet sequence during ping requests.

Activity 3 - Analyze ICMP Time Exceeded Traffic

To analyze ICMP Time Exceeded traffic:

1. In the top Wireshark packet list pane, select the second ICMP packet, labeled Time-to-live exceeded.
2. Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 4 / Internet Control Message Protocol frame.
3. Expand Internet Protocol Version 4 to view IPv4 details.
4. Observe the Source. This is the IP address of the router where the time was exceeded.
5. Expand Internet Control Message Protocol to view ICMP details.
6. Observe the Type. Notice that the type is 11 (Time-to-live exceeded).
7. Observe the Code. Notice that the code is 0 (Time to live exceeded in transit).
8. Observe the fields that follow. Notice that the contents of the request packet are returned with the time exceeded error.
9. Close Wireshark to complete this activity. Quit without Saving to discard the captured traffic.

References

• Wireshark: User's Guide
• Wireshark: Internet Control Message Protocol