Hello, guys, and welcome to another video
on this chapter in this video, we're going to learn how
the ICMP protocol works with the help of Wireshark.
Of course, ICMP or Internet control
message protocol is Internet or Network layer protocol in general.
It is used to check the reachability of a host or Router in a network.
Inter or Traceroute uses ICMP as in the protocol uses ICMP Hacker request and ICMP
Hacker reply messages to check whether destination host is reachable or not.
Although ICMP packets have a data section.
The purpose is not to rob and carry protocols like HTTP and DNS.
Instead, it is designed as a low level management protocol for the Internet.
So the ICMP packet size
at the network layer consists of the first IP header, which is
20 Bytes Rootkit BIOS 20 Byte then is the section that is called the
ICMP Header, which in total consists of eight bytes.
As you can see the type which is
WAN Byte, the code, one Byte and so on and so forth.
And the last one, as we said, is the data section
or ICMP payload, which occupies the rest of the Byte, which means in this case
is one thousand four hundred seventy two bytes maximum.
Of course, in the data section it can be
used less than that, like thirty Byte or 1000 bytes and so on.
The maximum transmission unit need the
MPU, the IP maximum transmission unit VMtu for the network player is one thousand
five hundred Bytes now the size of the ICMP.
Packet at the datalink layer,
uh, it's a little bit more that because of the another header sitting on top, which
occupies 14 Byte and then A and then it is the same, the AP header occupies 20 Byte.
I stand at the ICMP Header is 8 Bytes, as we discussed before and.
In this case, the the data section, the ICMP payload is again one thousand four
hundred seventy two Bytes maximum in total.
If you add the other header for the datalink layer, the packet size,
the IcmP packet size is one thousand five hundred and fourteen.
The maximum, the mission unit.
So the ICMP query codes are type zero, which is the echo reply type eight, which
is the echo request type nine, which is the Router advertisement, type 10, the
Router solicitation type 13, timestamp request and Type 14 timestamp reply.
A ping command sends an ICMP Echo request to the target host the target host
response with an echo reply, which means the target host is alive.
So as shown in these two slides, a ping packet.
So as shown in this slide, a ping packet
and any ICMP packet in general is fairly simple.
The first two values in the packet are the
type and code indicating the purpose of the packet.
Then the packet contains checksum, which is important since a single Bit flip
in the type or code can convey a completely different error message.
After that, ping packets contain
identifiers and sequence numbers, since ICMP is a stateless protocol.
These values help to match a response
received by the sender to the corresponding request.
The ICMP error codes are type three,
which means destination unreachable type for that this.
Type 4 Sourse Quench Type five is a
redirect type 11 time exceeded and type 12 parameter problems.
The ICMP protocol is designed to provide
error information and perform simple diagnostic actions.
As such, even passive monitoring of ICMP
traffic on a network can provide a wealth of data to an adversary.
Eavesdropping on ICMP packet can help to identify the hosts on the network and if
certain systems are down or malfunctioning.
So let's just go ahead on our command prompt and try to explore
the ping requests at the same time we are trying at the same time we will capture.
The traffic.
And see how that translates
on Wireshark, so start capturing And then let's go to our command prompt.
So let us explore the simple command and see what happens is the ping IP address.
So let's just go ahead and ping an IP address.
So as you can see from the below results,
after we pinged an IP address, you can see that there is a reply from the
host and there is also a couple of more things.
You can see that the full size of the
payload sent by our machine in this case is 32 Byte.
This is the request.
The same size of payload received by the source machine, which is 32 Bytes from.
The destination machine.
This is the reply.
The total packets are eight, four packets
are sent and four of them are replies to our machine.
So let's go to Wireshark and check how all this information being translated.
This captured the traffic.
So stop the traffic capture and.
We can filter the results with.
The IP address, the destination IP address.
Typing to one nine two one six eight eight eight two five four.
So also, now that we found the ICMP
Protocol column, we're going to we're going to have a look at this information.
So as you can see, the length is 74.
And it starts with the request from our machine.
It's an ICMP echo requests,
so that means that the length is seventy four Bytes length is consisted of.
The data, the payload size, which is 32, the ICMP header, which is 20 Bytes, the IP
had the 20 Byte and the Internet hit the 14 Byte, as we discussed previously on the
slides that we were explaining, the icmp packet size.
So if you go to
you highlight the first ping request and go to below Internet Control
message protocol, you can see that this is a type eight echo ping request.
Indicated here.
You can see also that the reply from the
other machine, the other IP address repeat is in the same length.
When we ping an IP, sometimes we don't get an echo reply.
From the host machine, instead of that, we
get some replies such as destination unreachable or Time exceeded
and this we discussed earlier in our slides, these are the ICMP ERROR codes.
There are many reasons behind such a kind of error message.
Possibly a host in a network is down or
Firewall is broken, ping request and so on.
So let ping an IP address that it's not reachable.
So you can see after we ping this IP
address, which know this a machine with this IP address, it is
right now powered but the Firewall is blocking our ping request.
Now, since we captured this whole
transaction between these two machines with Wireshark, they just go to Wireshark
and check what the information saying they're.
This is fitted out with the ICMP
protocol on the display filter, and you can see that when we try to think that IP
the destination IP was not reachable, as you can see in the Internet message
protocol there code is type three destination unreachable.
We can also use flags with a ping command
when we are ping an IP address and we can
use in this case ping dash a and again.
So in this case, Dash a resource, the IP address to a hostname
identifies that reverse name resolution is carried out on the host IP address.
If it is successful, ping shows the matching hostname lets go hit enter.
So as you can see, we.
Got a name back in this case.
This is my Router named Arcadyan, and you can see that the reply.
And you can see that the ping shows the exact matching
name of that device that we just pinged, it is go to Wireshark as well and check
what is going on there with the stop capturing the traffic again.
And filter out by ICMP.
So you can see in the same manner we have
an echo ping request and a reply from our there with the same length
by default, the ping command sends for packets of the request and receives the
same number of the packet as a reply from the host.
You can also increase or decrease this
number of the packet by using the command with the flag dash n
so we can bring dash n and we can send 8 packages.
To.
Destination IP.
So as you can see.
There is 4 packets.
Of request, so we got so as you can see, we had these
dash n 8 packets of request and thus
we received Bug a reply 8 packet.
As we have discussed the default sides of
ICMP payload is 32 Bytes, as you can see also from the command
prompt, the maximum is one thousand four hundred seventy two.
If the size of the payload packet is
greater than that, then the packet gets fragmented into small
packets so we can modify the size of the payload using the command ping dash -l
and this time we are going to have thirty three Byte of the payload.
And we are going to send it in the same destination, IP.
And see what happens.
So now let's go to Wireshark and see what's going on there.
That's look out by ICMP protocol go.
All the way down.
So in the last ping that we changed the payload size, you can do the math.
The length of the packet, when we send the request and the reply changed to 75.
Because the payload Byte increased.
So let us go ahead now and try to send the
maximum size of payload using the following command dash all the same and.
As we explain, the maximum payload size is a one four seven two, and
we are going to use, again, the same destination.
Most IP.
Which is a Router press enter.
And see that the Byte have changed.
Let's go to Wireshark now and see how is that information translated there.
We again filter out by ICMP and as you can see.
The length changed to one thousand five hundred fourteen, as we explained.
So when the size now of the PAYLOAD is
greater than 14, 72 or too large for a network to hold and
reach Router Router breaks it into smaller packets, which are called fragments.
So let's just go ahead and explore this
situation by typing ping dash -l all in the same manner.
And then we are going to type one four seven three.
Or you can type one four seven four, then the.
Destination IP.
And see what happens now in this case.
So let's explore this situation and Wireshark and see how the
packets are being broken into smaller packets.
So back to our Wireshark.
So Bug.
Bug.
After we stop capturing the traffic, we can go ahead again and type
ICMP and filter out the results and you can see that.
So let us go ahead and filter out by the
destination IP and take for any ICMP packet.
So as you can see from the results, we are being presented here with the
length one thousand five hundred fourteen as fragmented protocol.
So
if you do the math that when the payload is more than 1472, it gets
fragmented and it sends the the maximum to you, which is 14, 15.
And what is also added is the remaining mtu.
capacity, which is 36.
So you can see it sent for 15, 14 and then 36 minutes to reply and then the same.
So now these results . We don't see it, one following each other.
This is the way it's been broken down into a small packets.
We can also use the dash F option with the ping command, and this type of option
will not allow the packet fragmentation in the network.
So this is go ahead and use the. same
same command as before, but this time before dash l, we can type dash f.
So we are not going to let.
The packet been fragmented into smaller ones, so lets just.
Keep under.
And you see that
we received the information that the package needs to be fragmented.
So let's move
right away to Wireshark and see how that information has been translated.
So if we put out by ICMP protocol again, so we have only the results of our ping
command, you can see that we are receiving the destination unreachable error.
Which means that the it didn't go
to our destination might be because it needs to be fragmented first, it was too
big for the network to transfer it to the destination IP.
So that was it for the last video of this chapter.
And when you're ready, you can move on to chapter two.