ICMP — end of module

What this checks. That you can read an ICMP message as evidence rather than as noise. You need 3 of 4 to pass, and every option is explained afterwards — including the ones you did not pick.

1. 1/4Which of these is an ICMP error message rather than an informational one?

   Tell two ideas apart

   Time Exceeded

   Echo Request

   Echo Reply
2. 2/4A ping to a remote host fails. Which capture contents best show that a ROUTER discarded the packet rather than the destination being switched off?

   Choose the evidence

   An ICMP Destination Unreachable arriving from a router's own address

   Echo requests going out with no reply at all

   Echo requests with a TTL of 64
3. 3/4A firewall administrator proposes blocking all ICMP inbound. Which real consequence should be raised?

   Apply it somewhere new

   Path MTU discovery depends on Fragmentation Needed messages getting back, so connections can hang on large transfers

   TCP would stop retransmitting

   DNS would stop working entirely
4. 4/4Why does an ICMP error carry a copy of the packet that caused it?

   Match a field to its purpose

   So the sender can tell which of its own conversations the error belongs to

   So the router can retransmit it later

   So the receiver can verify the checksum of the original