CyberSecurity2_Module 7 & 8-My questions

Internet Control Message Protocol

is to provide feedback about issues related to the processing of IP packets under certain conditions, not to make IP reliable.

• • Host confirmation
• • Destination or Service Unreachable
• • Time exceeded
• • Route redirection

• • An ICMP Echo Message can be used to determine if a host is operational.
• • The local host sends an ICMP Echo Request to a host. If the host is available, the destination host responds with an Echo Reply.

When a host or gateway receives a packet that it cannot deliver, it can use an ICMP Destination Unreachable message to notify the source that the destination or service is unreachable.

• • 0 - Net unreachable
• • 1 - Host unreachable
• • 2 - Protocol unreachable
• • 3 - Port unreachable

Net unreachable

Host unreachable

Protocol unreachable

Port unreachable

• An ICMPv4 Time Exceeded message is used by a router to indicate that a packet cannot be forwarded because the Time to Live (TTL) field of the packet was decremented to 0. If a router receives a packet and decrements the TTL field in the IPv4 packet to zero, it discards the packet and sends a Time Exceeded message to the source host.

• • ICMPv6 also sends a Time Exceeded message if the router cannot forward an IPv6 packet because the packet has expired.
• • IPv6 does not have a TTL field. It uses the hop limit field to determine if the packet has expired.

ICMPv6 messages are encapsulated in IPv6.

• • Router Solicitation (RS) message
• • Router Advertisement (RA) message

• • Neighbor Solicitation (NS) message
• • Neighbor Advertisement (NA) message

• messaging between an IPv6 router and an IPv6 device?
• • Router Solicitation (RS) message
• • Router Advertisement (RA) message

• messaging between IPv6 devices?
• • Neighbor Solicitation (NS) message
• • Neighbor Advertisement (NA) message

Ping is an IPv4 and IPv6 testing utility that uses ICMP echo request and echo reply messages to test connectivity between hosts.

• • To test connectivity to another host on a network, an echo request is sent to the host address using the ping command. If the host at the specified address receives the echo request, it responds with an echo reply.
• • As each echo reply is received, ping provides feedback on the time between when the request was sent and when the reply was received. This can be a measure of network performance.

• • If a reply is not received within the timeout, ping provides a message indicating that a response was not received.
• • This may indicate that there is a problem, but could also indicate that security features blocking ping messages have been enabled on the network.

• • Pinging the local loopback
• • Pinging the default gateway
• • Pinging the remote host

A successful ping to the default gateway indicates that the host and the router interface serving as the default gateway are both operational on the local network.

• • Ping can be used to test the internal configuration of IPv4 or IPv6 on the local host.
• • A response indicates that IP is properly installed on the host.
• • AKA test if the TCP/IP stack is operational
• • An error message indicates that TCP/IP is not operational on the host.

• • Ping the default gateway tests if a host can communicate on the local network.
• • If either the default gateway or another host responds, then the local host can successfully communicate over the local network.
• • If the default gateway does not respond but another host does, this could indicate a problem with the router interface serving as the default gateway.

A successful ping to the default gateway indicates that the host and the router interface serving as the default gateway are both operational on the local network.

• • Ping to a remote host tests the ability of a local host to communicate across an internetwork.
• • The router uses its IP routing table to forward the packets.

• • A successful ping confirms communication on the local network, the operation of the router serving as the default gateway, and the operation of all other routers that might be in the path between the local network and the network of the remote host.
• • Additionally, the functionality of the remote host can be verified.

• Ping does not provide information about the details of devices between the hosts.
• We can use traceroute (tracert) for that.
• Ping is used to test connectivity between two hosts

• • is a utility that generates a list of hops that were successfully reached along the path.
• • This list can provide important verification and troubleshooting information.

• • If the data reaches the destination, then the trace lists the interface of every router in the path between the hosts.
• • If the data fails at some hop along the way, the address of the last router that responded to the trace can provide an indication of where the problem or security restrictions are found.

• • The round-trip time is the time a packet takes to reach the remote host and for the response from the host to return.
• • An asterisk (*) is used to indicate a lost or unreplied packet.
• • If the display shows high response times or data losses from a particular hop, this is an indication that the resources of the router or its connections may be overused.

• • 0 – Echo reply (response to a ping)
• • 3 – Destination Unreachable
• • 5 – Redirect (use another route to your destination)
• • 8 – Echo request (for ping)
• • 11 – Time Exceeded (TTL became 0)

Echo reply (response to a ping)

Destination Unreachable

Redirect (use another route to your destination)

Echo request (for ping)

Time Exceeded (TTL became 0)

• • Destination MAC address – This is the MAC address of the file server’s Ethernet NIC.
• • Source MAC address – This is the MAC address of PC-A’s Ethernet NIC.

• • Source IP address – This is the IP address of the original source, PC-A.
• • Destination IP address – This is the IP address of the final destination, the file server.

• • MAC addresses are used to deliver the data link frame with the encapsulated IP packet from one NIC to another NIC on the same network.
• • If the destination IP address is on the same network, the destination MAC address will be that of the destination device.
• • If the destination IP address is not on the same network, the destination MAC address will be that of the default gate way.

• • Resolving IPv4 addresses to MAC addresses
• • Maintaining a table of IPv4 to MAC address mappings

What is ARP reply?