Wireshark/ICMPv6 Trace

Wireshark is a free and open source packet analyzer used for network troubleshooting and analysis. These activities will show you how to use Wireshark to capture and analyze tracert/traceroute traffic. Tracing routes is accomplished through the use of Internet Control Message Protocol (ICMPv6) Time Exceeded.

Readings

• Wikipedia: Internet Control Message Protocol Version 6 (ICMPv6)

Preparation

To prepare for this activity:

1. Start Windows.
2. Log in if necessary.
3. Install Wireshark.

Activity 1 - Capture Tracert Traffic

To capture ICMPv6 tracert traffic:

1. Start a Wireshark capture.
2. Open a command prompt.
3. Type tracert -d 2001:4860:4860::8888 and press Enter to trace the route to one of Google's public IPv6 DNS servers. The -d option prevents DNS name resolution, which in this case will improve performance and reduce the amount of captured traffic.
4. When the trace is complete, close the command prompt.
5. Stop the Wireshark capture.

Activity 2 - Analyze Tracert Traffic

To analyze tracert traffic:

1. Observe the traffic captured in the top Wireshark packet list pane. Look for traffic with ICMPv6 listed as the protocol. To view only ICMPv6 traffic, type icmpv6 (lower case) in the Filter box and press Enter.
2. Select the first ICMPv6 packet, labeled Echo (ping) request.
3. Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 6 / Internet Control Message Protocol frame. Note if you are using an IPv6 tunnel, your IPv6 packet may be encapsulated inside an IPv4 or UDP packet.
4. Expand Internet Protocol Version 6 to view IPv6 details.
5. Observe the Hop limit. Notice that the hop limit is set to 1.
6. Expand Internet Control Message Protocol v6 to view ICMPv6 details.
7. Observe the Type. Notice that the type is Echo (ping) request (128). Tracert is performed through a series of ICMPv6 Echo requests, varying the hop limit until the destination is found.
8. In the top Wireshark packet list pane, select the second ICMPv6 packet, labeled Time Exceeded.
9. Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 6 / Internet Control Message Protocol frame. Again, if you are using an IPv6 tunnel, your IPv6 packet may be encapsulated inside an IPv4 or UDP packet.
10. Expand Internet Protocol Version 6 to view IPv6 details.
11. Observe the Source. This is the IPv6 address of the router where the time was exceeded.
12. Expand Internet Control Message Protocol v6 to view ICMPv6 details.
13. Observe the Type. Notice that the type is Time Exceeded (3).
14. Observe the Code. Notice that the code is 0 (hop limit exceeded in transit).
15. Observe the fields that follow. Notice that the contents of the request packet are returned with the time exceeded error.
16. Continue selecting alternate ICMPv6 Echo Request and ICMPv6 Time Exceeded packets. Notice that the request is repeated three times for each hop limit count, and each reply indicates the IPv6 address of the router where the time to live was exceeded.
17. Close Wireshark to complete this activity. Quit without Saving to discard the captured traffic.

References

• Wireshark: User's Guide
• Wireshark: ICMPv6