IP Fragmenatation Example 1

• command(s) to generate data: ping –c1 –s4096 192.168.1.1
  
• command to capture data: tcpdump –tenx ip host c150
  
• note NO ethernet headers
  

        4500 05dc f6b4 2000 4001 da85 c0a8 0196
        c0a8 0101 0800 a070 7609 0000 a40b ee45
        312c 0a00 0001 0203 0405 0607 0809 0a0b
        0c0d 0e0f 1011 1213 1415 1617 1819 1a1b
        1c1d 1e1f 2021 2223 2425 2627 2829 2a2b 2c2d

        4500 05dc f6b4 20b9 4001 d9cc c0a8 0196
        c0a8 0101 b8b9 babb bcbd bebf c0c1 c2c3
        c4c5 c6c7 c8c9 cacb cccd cecf d0d1 d2d3
        d4d5 d6d7 d8d9 dadb dcdd dedf e0e1 e2e3
        e4e5 e6e7 e8e9 eaeb eced eeef f0f1 f2f3 f4f5

        4500 048c f6b4 0172 4001 fa63 c0a8 0196
        c0a8 0101 8081 8283 8485 8687 8889 8a8b
        8c8d 8e8f 9091 9293 9495 9697 9899 9a9b
        9c9d 9e9f a0a1 a2a3 a4a5 a6a7 a8a9 aaab
        acad aeaf b0b1 b2b3 b4b5 b6b7 b8b9 babb bcbd

        4500 05dc e8e9 2000 4001 e850 c0a8 0101
        c0a8 0196 0000 a870 7609 0000 a40b ee45
        312c 0a00 0001 0203 0405 0607 0809 0a0b
        0c0d 0e0f 1011 1213 1415 1617 1819 1a1b
        1c1d 1e1f 2021 2223 2425 2627 2829 2a2b 2c2d

        4500 05dc e8e9 20b9 4001 e797 c0a8 0101
        c0a8 0196 b8b9 babb bcbd bebf c0c1 c2c3
        c4c5 c6c7 c8c9 cacb cccd cecf d0d1 d2d3
        d4d5 d6d7 d8d9 dadb dcdd dedf e0e1 e2e3
        e4e5 e6e7 e8e9 eaeb eced eeef f0f1 f2f3 f4f5

        4500 048c e8e9 0172 4001 082f c0a8 0101
        c0a8 0196 8081 8283 8485 8687 8889 8a8b
        8c8d 8e8f 9091 9293 9495 9697 9899 9a9b
        9c9d 9e9f a0a1 a2a3 a4a5 a6a7 a8a9 aaab
        acad aeaf b0b1 b2b3 b4b5 b6b7 b8b9 babb bcbd

1. Look at the commands used to generate the packets and understand what is taking place (see man pages if necessary).

2. Focusing on the first three packets, identify all pieces of these packets. Make sure you can identify the order of these packets.

3. Make sure you understand the flags and the fragment offset fields.