TTL（7/11,22min）

TTL（Time to Live） Time to live , Similar to blood trough

prevent IP Packets are transmitted endlessly in the network （ The loop ）

Every time you go through a route （ Find the routing table once ）,TTL The value will decrease 1

When TTL=0 when , Discard packets

  utilize TTL Can realize the route tracing technology , For troubleshooting .

TTL It's usually 64、128、256

adopt ping -i command , Know the number of people who visit a certain address i Who is it , as follows ：

C:\Users\Admin>ping www.baidu.com -i 1

 is  Ping www.a.shifen.com [112.80.248.76]  have  32  Bytes of data :
 come from  192.168.1.1  Reply to : TTL  Expired in transmission .
 come from  192.168.1.1  Reply to : TTL  Expired in transmission .
 come from  192.168.1.1  Reply to : TTL  Expired in transmission .
 come from  192.168.1.1  Reply to : TTL  Expired in transmission .

112.80.248.76  Of  Ping  Statistics :
     Data packets :  Has been sent  = 4, Received  = 4, The loss of  = 0 (0%  The loss of ),

You can see the first jump （ Usually gateway , The gateway is a default route by default ） by 192.168.1.1, That is, the address of the wireless router of the author .

Use tracert -d（ Do not resolve addresses to domain names ） Commands are more convenient ：

C:\Users\Admin>tracert -d www.baidu.com

 Pass the most  30  Two hop tracking 
 To  www.a.shifen.com [112.80.248.75]  The routing :

  1     1 ms    <1  millisecond     1 ms  192.168.1.1  // wireless router 
  2     1 ms     1 ms     *     172.20.x.1  // At the next higher level DHCP The server 
  3     1 ms     1 ms    <1  millisecond  192.168.x.x // Core switch layer 3 SVI Interface 
  4     2 ms     3 ms     2 ms  119.39.176.177 // Operators Export 
  5     2 ms     2 ms     2 ms  119.39.176.133
  6     2 ms     2 ms     3 ms  110.52.127.249
  7    25 ms    24 ms    19 ms  219.158.15.217
  8    22 ms    23 ms    22 ms  153.3.228.142
  9    23 ms    22 ms    22 ms  153.37.96.134
 10     *        *        *      request timeout .  // The other party may have PING Protect 
 11    21 ms    21 ms    22 ms  112.80.248.75

Each hop sends three ICMP package , And in the bag TTL The value is incremented to calculate

eNSP Simulator usage and TTL Loop test （27min）

Winpcap（ Packet capture driver ）;Wireshark（ Grab the package software ）;VirtualBox（ A virtual environment , Mainly used for routers ）

This series of courses mainly use equipment AR2220、S5700/S3700

The installation and use of simulator are not detailed , The topology is as follows ：

AR1 To configure ：

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]un in en
Info: Information center is disabled.
[Huawei]sysname R1
[R1]int gi0/0/0
[R1-GigabitEthernet0/0/0]ip add 12.0.0.1 24
[R1-GigabitEthernet0/0/0]ip route-s 8.8.8.8 32 12.0.0.2
// As long as it's going to 8.8.8.8 Of traffic , Give it all to 12.0.0.2

AR2 To configure ：

<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]un in en
Info: Information center is disabled.
[Huawei]sysname R2
[R2]int gi0/0/0
[R2-GigabitEthernet0/0/0]ip add 12.0.0.2 24
[R2-GigabitEthernet0/0/0]ip route-s 8.8.8.8 32 12.0.0.1

stay AR1 Of Gigabitethernet 0/0/0 Grab the bag by mouth , And in AR1 tracert 8.8.8.8

[R1]tracert 8.8.8.8
--------
 traceroute to  8.8.8.8(8.8.8.8), max hops: 30 ,packet length: 40,press CTRL_C t
o break 

 1 12.0.0.2 120 ms  20 ms  20 ms 

 2 12.0.0.1 10 ms  10 ms  10 ms 

 3 12.0.0.2 20 ms  20 ms  20 ms 

 4 12.0.0.1 10 ms  10 ms  10 ms 

 5 12.0.0.2 40 ms  30 ms  20 ms 
......
 loop 30 Time （max hops：30）

stay AR1 On ping 8.8.8.8, And check the packet capture ：

[R1]ping 8.8.8.8
  PING 8.8.8.8: 56  data bytes, press CTRL_C to break
    Request time out

  --- 8.8.8.8 ping statistics ---
    1 packet(s) transmitted
    0 packet(s) received
    100.00% packet loss

Default TTL by 255, Let's look at the last ICMP package （ common 255 individual ）：

The type is 11, Encoded as 0, It will not be indicated here “TTL=0”, Respond only “Time To Live only 1”, The previous package of the package TTL The value is 1

Relevant reference ： How does the router handle ttl by 1 or 0 My bag _ info sec & pen test Technology blog _51CTO Blog

Agreement No （7/13,3min）

Agreement No , Used to identify the upper layer protocol .

1：ICMP;2：IGMP;6：TCP;

9：IGRP;17：UDP;47：GRE;

50：ESP;51：AH;57：SKIP;

88：EIGRP;89：OSPF;115：L2TP

Give an application layer protocol as DNS, Then the transport layer protocol is UDP, The network layer is IPv4, The data link layer is Ethernet.

Ethernet Ⅱ There is a goal in MAC, Source MAC, Agreement type is 0800（IP）

IP There is a version number in the agreement , Head length , Fragmentation ,TTL, Agreement type is 17（UDP）

UDP There is a target port in the Protocol ,53