See all four headers in one captured packet

short · 25 min · Objective 1.1

Task

Capture a single ping between your two lab hosts and identify, by eye, the Ethernet header, the IP header and the ICMP message inside one frame. Encapsul- ation stops being an abstraction the first time you see the layers nested in real bytes.

Steps

  1. On Host A, start a capture restricted to ICMP so the output is readable: sudo tcpdump -i eth0 -n -v icmp. The -n matters: name resolution would add DNS traffic to the capture you are trying to read.
  2. From a second terminal on Host A, run ping -c 1 192.168.20.10.
  3. Read the captured line. Identify the source and destination IP addresses (layer 3) and the ICMP type (layer 4's neighbour — ICMP sits at layer 3 but is carried as an IP payload).
  4. Re-run the capture with -e to add the Ethernet header: sudo tcpdump -i eth0 -n -e icmp. Now note the destination MAC address.
  5. Answer the question that matters: the destination IP is on the far subnet, but whose MAC address is in the frame? Compare it against ip neigh show on Host A.

Verify

sudo tcpdump -i eth0 -n -e -c 2 icmp
ip neigh show 192.168.10.1

The destination MAC in the outgoing frame must equal the router's MAC from ip neigh, not Host B's. If you can explain why, you have understood the one thing this lesson exists to teach.

Notes

The layer 2 address changes at every hop; the layer 3 address does not. That is encapsulation doing its job — each layer addresses its own scope, and the frame is rebuilt at every router while the packet inside it is carried unchanged.

Try it again with -vv and watch the TTL. Host A sends 64; whatever Host B receives is 63, and that single decrement is the whole of how traceroute works.