Sniffing ICMP (Ping) Packets in GNS3 Using Wireshark

Nerd Cafe | نرد کافه

What ICMP Is

• ICMP is a network layer (Layer 3) protocol.

• It’s used for error reporting and network diagnostics, not for data transfer.

• Works alongside IP, not independently.

Main Purposes of ICMP

• Reports network errors (e.g., destination unreachable).

• Helps with troubleshooting and testing network connectivity.

• Provides status and control messages about IP packet delivery.

Common ICMP Message Types

• Echo Request / Echo Reply → Used by ping.

• Destination Unreachable → Target or route cannot be reached.

• Time Exceeded → Packet’s TTL expired (used by traceroute).

• Redirect → Router suggests a better route.

• Parameter Problem → Invalid IP header field.

ICMP in Network Tools

• Ping

  • Tests host reachability.

  • Measures round-trip time (RTT).

C:\>ping google.com

Pinging google.com [216.239.38.120] with 32 bytes of data:
Reply from 216.239.38.120: bytes=32 time=58ms TTL=114
Reply from 216.239.38.120: bytes=32 time=59ms TTL=114
Reply from 216.239.38.120: bytes=32 time=69ms TTL=114
Reply from 216.239.38.120: bytes=32 time=60ms TTL=114

Ping statistics for 216.239.38.120:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 58ms, Maximum = 69ms, Average = 61ms

C:\>

• Traceroute

  • Maps the path packets take to a destination.

  • Uses TTL expiration + ICMP Time Exceeded messages.

C:\>tracert google.com

Tracing route to google.com [216.239.38.120]
over a maximum of 30 hops:

  1     1 ms    <1 ms     1 ms  192.168.1.1
  2     *        *        *     Request timed out.
  3    24 ms    30 ms    33 ms  10.176.211.65
  4     *        *        *     Request timed out.
  5    34 ms    38 ms    49 ms  10.136.131.142
  6    63 ms    54 ms    57 ms  10.21.249.50
  7     *       65 ms     *     213.202.7.254
  8    75 ms    68 ms    62 ms  213.202.5.239
  9    59 ms    66 ms    56 ms  216.239.48.133
 10    58 ms    54 ms    64 ms  192.178.96.1
 11    58 ms    52 ms    52 ms  any-in-2678.1e100.net [216.239.38.120]

Trace complete.

C:\>

Security Considerations

• ICMP can be abused for DoS attacks (e.g., ping flood).

• Often filtered or rate-limited by firewalls.

• Blocking all ICMP is bad practice—it can break diagnostics and path MTU discovery.

Lab Objectives

• Configure two hosts in the same subnet

• Verify connectivity using ICMP (Ping)

• Capture and analyze ICMP traffic

• Understand ICMP Echo Request / Echo Reply behavior at packet level

Lab Topology

• No switch, no router (direct L2 communication)

• Same broadcast domain

Tools Used

• GNS3 (or similar emulator)

• VPCS (Virtual PC Simulator)

• Wireshark (packet capture)

Step 1: Build the Topology

1. Add 2 × VPCS nodes:

   • Name them PC1 and PC2

2. Connect:

   • PC1 Ethernet0 → PC2 Ethernet0

3. Start both VPCS nodes

Step 2: Configure IP Addressing

Configure PC1

PC1> ip 192.168.0.1/24
PC1> save

Configure PC2

PC2> ip 192.168.0.2/24
PC2> save

Both PCs are now in the same subnet (192.168.0.0/24)

Step 3: Start Packet Capture

1. Right-click the link between PC1 ↔ PC2

2. Select Start Capture

3. Open capture in Wireshark

4. Apply display filter:

icmp

Step 4: Generate ICMP Traffic

From PC1, ping PC2:

PC1> ping 192.168.0.2

Step 5: ICMP Echo Request / Reply Flow

ICMP Echo Request

• Source IP: 192.168.0.1

• Destination IP: 192.168.0.2

• Type: 8 (Echo Request)

• TTL: 64

ICMP Echo Reply

• Source IP: 192.168.0.2

• Destination IP: 192.168.0.1

• Type: 0 (Echo Reply)

• TTL: 64

Step 6: Security & Sniffing Perspective (CEH Focus)

• ICMP is clear-text → fully sniffable

• Useful for:

  • Network mapping

  • Host discovery

• Dangerous if abused:

  • Ping flood

  • ICMP tunneling

• Often rate-limited, not fully blocked

💖 Support Our Work

If you find this post helpful and would like to support my work, you can send a donation via TRC-20 (USDT). Your contributions help us keep creating and sharing more valuable content.

TRC-20 Address: TAAVVf9ZxUpbyvTa6Gd5SGPmctBdy4PQwf

Thank you for your generosity! 🙏

Keywords

ICMP, Echo Request, Echo Reply, Ping, Traceroute, ARP, TTL, Sequence Number, Identifier, Packet Capture, Wireshark, VPCS, IP Addressing, Ethernet, Broadcast, Unicast, OSI Layer 3, Network Diagnostics, Sniffing, Latency, nerd cafe , نرد کافه

Channel Overview

🌐 Website: www.nerd-cafe.ir

📺 YouTube: @nerd-cafe

🎥 Aparat: nerd_cafe

📌 Pinterest: nerd_cafe

📱 Telegram: @nerd_cafe

📝 Blog: Nerd Café on Virgool

💻 GitHub: nerd-cafe