IPv4 - Wireshark Labs Labs Features Pricing Testimonials FAQ Leaderboard Updates Search… k Wireshark Labs Unlock full labs Intro0/2 Key Features0/9 Traffic Capture0/2 Using Filters0/3 Configure0/2 Network Layer0/4Ethernet IPv4Sample ICMPv4 IPv6 and ICMPv6 Protocols0/4 Troubleshoot0/4 Extras0/1 More0/2 IPv4 IPv4 remains the primary protocol for internet routing. This lab analyzes IPv4 headers, addressing, Time-to-Live (TTL) values, and fragmentation mechanics. Fun Fact: There are exactly 4,294,967,296 possible IPv4 addresses. While that sounded like plenty in the 1980s, we "ran out" of new ones years ago, leading to the rise of NAT and IPv6! Task 1 Download PCAP ipv4-1.pcapng How many Layer 3 hops are between host 192.168.1.124 and 1.1.1.1? Answer Reveal hint #1 (-4 points)Submit Apply the filter ip.proto == 1. Make sure to have IPv4 reassembly turned on (it is the default). What is true about packets 21–23 in relation to IP fragmentation? Select 4 option(s) The IP Identification field changes for each fragment The IP Identification field stays the same across all fragments The 'More Fragments' flag is set on the first fragment The 'More Fragments' flag is cleared on the last fragment Each fragment has a completely different source IP address Fragments are reassembled by switches before reaching the destination host The fragment offset indicates where each piece belongs in the original datagram Reveal hint #1 (-4 points)Submit Filter for IPv6 packets. Is there any fragmentation visible in this capture? Select 1 option(s) Yes No Submit Task 2 Download PCAP ipv4-2.pcapng Which IP Identification (IP ID) generation method is used by host 192.168.129.167? Select 1 option(s) It increments IP IDs separately for each connection It uses a global IP ID counter, incrementing it for every packet to any destination It generates random IP IDs for each packet It always sets the IP ID field to zero Reveal hint #1 (-4 points)Submit Task 3 Download PCAP ipv4-3.pcapng Which IP Identification (IP ID) generation method is used by host 192.168.1.140? Select 1 option(s) A single global counter that increments for every packet to any destination A separate incrementing counter per destination (per remote IP) Random IP IDs for each packet A counter that increments per TCP/UDP connection only The IP ID field is always set to zero Reveal hint #1 (-4 points)Submit Task 4 Questions without a PCAP: In Wireshark, which field shows the total length of the IP packet (header + payload)? Select 1 option(s) IP Total Length Ethernet Frame Length IP Header Checksum Protocol ID Reveal hint #1 (-4 points)Submit You see three packets with the same IP Identification value. Two have the 'More Fragments' flag set, and one does not. What does this indicate? Select 1 option(s) The packets are unrelated These are fragments of the same original datagram They are from different flows with the same IP ID They indicate packet retransmissions Reveal hint #1 (-4 points)Submit You capture traffic at both an internal host (10.0.0.25) and the Internet side of the router. Internally, the host uses 10.0.0.25 → 8.8.8.8, but externally you see 203.0.113.5 → 8.8.8.8. What happened? Select 1 option(s) The router performed Network Address Translation (NAT) The host has two IP addresses The ISP assigned a duplicate address The DNS server changed the source IP Reveal hint #1 (-4 points)Submit Which of the following is a multicast IPv4 address range? Select 1 option(s) 192.168.0.0 – 192.168.255.255 169.254.0.0 – 169.254.255.255 224.0.0.0 – 239.255.255.255 10.0.0.0 – 10.255.255.255 Reveal hint #1 (-4 points)Submit You see traffic from 169.254.23.45 in a capture. What does this address indicate? Select 1 option(s) It is a public IPv4 address It is a multicast address It is an APIPA address automatically assigned when DHCP fails It is a private RFC1918 address Reveal hint #1 (-4 points)Submit Why can NAT complicate packet analysis when capturing on the Internet side of a router? Select 1 option(s) NAT increases the TTL by one for every packet NAT removes the IP header from all packets Multiple internal hosts may appear as a single public IP NAT converts IPv4 packets into IPv6 packets Reveal hint #1 (-4 points)Submit Ready for the full labs? Get all 30 labs, 45 PCAPs, and 150 exam-style questions. Buy Lifetime Labs Access View Full Labs Details On this page On this page Task 1 Task 2 Task 3 Task 4 Solutions Labs WCA Course PacketSafari Support Support Company About Contact Legal ToS Courses GDPR Privacy Terms Pass your WCA exam footer.youtubefooter.linkedinfooter.linkedin Copyright © 2026 Packet Pioneer LLC - Ripka Technologies S.L. All rights reserved.