Include the saved output in your lab report. Explain the meaning of each field in the captured data.

What will be an ideal response?

```
PC1 % ping 10.0.1.12
PING 10.0.1.12 (10.0.1.12) from 10.0.1.11 56(84) bytes of data.
64 bytes from 10.0.1.12: icmp_seq=1 ttl=64 time=0.682 ms
5 packets transmitted, 5 received, 0% packet loss, time 3812ms
rtt min/avg/max/mdev = 0.682/0.682/0.682/0.000

{/code

PC1 %tcpdump –n host 10.0.1.12
```
19:44:27.050000 10.0.1.11 > 10.0.1.12: icmp: echo request (DF)
19:44:27.050000 10.0.1.12 > 10.0.1.11: icmp: echo reply (DF)
19:44:32.050000 arp who-has 10.0.1.11 tell 10.0.1.12
19:44:32.050000 arp reply 10.0.1.11 is-at 0:0:c0:ba:4f:0
```
Ping is used to see if a computer is operating and also to check if the network connections are
intact. Ping uses the Internet Control Message Protocol (ICMP) Echo function. When PC1 issues a ping to PC2, PC1 first sends a broadcast ARP address request on the network asking who has the ip-address 10.0.1.12. PC2 recognizes its ip address and gives a reply to PC1 with its MAC address. After PC1 receives PC2 ‘s MAC address the ICMP echo request is sent to PC2. Then PC2 replies with an ICMP echo reply. Next PC2 issues an ARP who-has packet in order to refresh the buffered PC1’s MAC address. PC1 answers with an ARP reply.
Tcpdump captures the flows through eth0 device. ARP request/reply and ICMP request-reply are captured. In tcpdump data, each column indicates time of packet departure, interface name, in or out delimiter, source address, in or out delimiter, protocol name, and protocol type respectively.