Explain what you observed in Steps 3, 4, and 5. Use the saved data to support your answers. Provide explanations of the observations. Try to explain each observed phenomenon (e.g., if you observe more ICMP Echo Requests than ICMP Echo Replies, try to explain the reason).

What will be an ideal response?

After step 5, the ARP tables and routing caches of PC1, PC2, and PC3 got updated with the MAC addresses of Router1 as well as the gateways to reach the other hosts. They now contain the MAC address of the directly connected interface of the router if the source and destination are not on the same subnet, or the MAC host, if they are on the same subnet.
```
[root@PC1 root]# arp
Address HWtype HWaddress Flags Mask Iface
10.0.1.1 ether 00:07:50:D0:9D:21 C eth0
[root@PC2 root]# arp
Address HWtype HWaddress Flags Mask Iface
10.0.2.138 ether 00:07:50:D0:9D:22 C eth0
[root@PC3 root]# arp
Address HWtype HWaddress Flags Mask Iface
10.0.2.138 ether 00:07:50:D0:9D:22 C eth0
```
Route cache also changes. Entries of routes to the hosts on the route would be added.
```
[root@PC1 root]# route -C
Kernel IP routing cache
Source Destination Gateway Flags Metric Ref Use Iface
PC1 PC1 PC1 l 0 0 26 lo
PC1 PC1 PC1 l 0 0 57 lo
PC1 PC1 PC1 l 0 0 196

[root@PC1 root]# route -C
Kernel IP routing cache
Source Destination Gateway Flags Metric Ref Use Iface
10.0.2.137 10.0.1.10 10.0.1.10 l 0 0 0 lo
10.0.1.10 10.0.2.10 10.0.1.1 0 0 2 eth0
PC1 PC1 PC1 l 0 0 135 lo
PC1 PC1 PC1 l 0 0 454 lo
10.0.1.10 10.0.2.137 10.0.1.1 0 0 0 eth0
10.0.1.10 10.0.2.137 10.0.1.1 0 0 2 eth0
10.0.2.10 10.0.1.10 10.0.1.10 l 0 0 0 lo
PC1 PC1 PC1 l 0 0 60 lo
10.0.1.10 10.0.2.10 10.0.1.1 0 0 0 eth0

[root@PC2 root]# route -C
Kernel IP routing cache
Source Destination Gateway Flags Metric Ref Use Iface
PC2 PC2 PC2 l 0 0 35 lo
PC2 PC2 PC2 l 0 0 13 lo
PC2 PC2 PC2 l 0 0 113 lo
```
Since PC4 is not on the route from PC1 to PC2 or PC3, no arp cache and routing cache has changed.
```
[root@PC1 root]# route -e
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
10.0.1.0 * 255.255.255.0 U 0 0 0 eth0
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
default 10.0.1.1 0.0.0.0 UG 0 0 0 eth0

[root@PC2 root]# route -e
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
10.0.2.0 * 255.255.255.0 U 0 0 0 eth0
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
default 10.0.2.138 0.0.0.0 UG 0 0 0 eth0

[root@PC3 root]# route -e
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
10.0.2.136 * 255.255.255.248 U 0 0 0 eth0
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
default 10.0.2.138 0.0.0.0 UG 0 0 0 eth0
```
From our ping results in step3, we see that the PC1 first performed an ARP resolution to obtain the MAC
address of its default gateway (10.0.1.1) after realizing the ICMP packets it was about to send were on a
subnet different from that of itself. Then it sent the ICMP echo requests to the default gateway after
obtaining the MAC address. When the gateway (i.e. Router1) got the ICMP packets, it performed the
necessary ARP resolution to obtain the MAC addresses of the destinations, and then forward it to the
corresponding destinations (i.e. PC2 and PC3). It is strange that according to the packets we captured on
PC4 as shown below, only 1 out of the 2 ICMP packets managed to get through the router and arrived
from PC1 to the other subsets. When we took a closer look at the detailed outputs of ethereal, we
discovered it was always the 2 nd ICMP echo request packet that will get through the router.
No. Time Source Destination Protocol Info
3 1.018847 10.0.1.10 10.0.2.10 ICMP Echo (ping) request
4 1.019029 10.0.2.10 10.0.1.10 ICMP Echo (ping) reply
5 31.011321 10.0.1.10 10.0.2.137 ICMP Echo (ping) request
6 31.011530 10.0.2.137 10.0.1.10 ICMP Echo (ping) reply
Cisco router document showed that this was something related to the router. It seems that whenever Cisco
router sees an ICMP packet, it will check to see if the destination MAC address is present in either the
packet or the router’s ARP cache, if the MAC address is not present in both places, the router will discard this packet, but it will also perform an ARP resolution for the destination IP address, then when the second ICMP echo request packet arrives it will be able to pull out the MAC from the cache and the second ICMP packet will be forwarded to that address. This explained why we observe only the second ICMP echo request being forwarded to the corresponding destinations.
```
[root@PC1 root]# ping -c 2 10.0.2.10
PING 10.0.2.10 (10.0.2.10) 56(84) bytes of data.
64 bytes from 10.0.2.10: icmp_seq=2 ttl=63 time=2.05 ms
--- 10.0.2.10 ping statistics ---
2 packets transmitted, 1 received, 50% packet loss , time 1013ms
rtt min/avg/max/mdev = 2.058/2.058/2.058/0.000 ms

[root@PC1 root]# ping -c 2 10.0.2.137
PING 10.0.2.137 (10.0.2.137) 56(84) bytes of data.
64 bytes from 10.0.2.137: icmp_seq=2 ttl=63 time=1.27 ms
--- 10.0.2.137 ping statistics ---
2 packets transmitted, 1 received, 50% packet loss , time 1015ms
rtt min/avg/max/mdev = 1.272/1.272/1.272/0.000 ms

Frame 1 (42 bytes on wire, 42 bytes captured)
Arrival Time: Aug 11, 2003 22:18:30.862086000
Time delta from previous packet: 0.000000000 seconds
Time relative to first packet: 0.000000000 seconds
Frame Number: 1
Packet Length: 42 bytes
Capture Length: 42 bytes
Ethernet II, Src: 00:50:bf:75:16:95, Dst: ff:ff:ff:ff:ff:ff
Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
Source: 00:50:bf:75:16:95 (00:50:bf:75:16:95)
Type: ARP (0x0806)
Address Resolution Protocol (request)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (0x0001)
Sender MAC address: 00:50:bf:75:16:95 (00:50:bf:75:16:95)
Sender IP address: 10.0.1.10 (10.0.1.10)
Target MAC address: 00:00:00:00:00:00 (00:00:00:00:00:00)
Target IP address: 10.0.1.1 (10.0.1.1)
Frame 2 (60 bytes on wire, 60 bytes captured)
Arrival Time: Aug 11, 2003 22:18:30.862765000
Time delta from previous packet: 0.000679000 seconds
Time relative to first packet: 0.000679000 seconds
Frame Number: 2
Packet Length: 60 bytes
Capture Length: 60 bytes
Ethernet II, Src: 00:07:50:d0:9d:21, Dst: 00:50:bf:75:16:95
Destination: 00:50:bf:75:16:95 (00:50:bf:75:16:95)
Source: 00:07:50:d0:9d:21 (00:07:50:d0:9d:21)
Type: ARP (0x0806)
Trailer: 00000000000000000000000000000000...
Address Resolution Protocol (reply)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reply (0x0002)
Sender MAC address: 00:07:50:d0:9d:21 (00:07:50:d0:9d:21)
Sender IP address: 10.0.1.1 (10.0.1.1)

Target MAC address: 00:50:bf:75:16:95 (00:50:bf:75:16:95)
Target IP address: 10.0.1.10 (10.0.1.10)
Frame 3 (98 bytes on wire, 98 bytes captured)
Arrival Time: Aug 11, 2003 22:18:30.862786000
Time delta from previous packet: 0.000021000 seconds
Time relative to first packet: 0.000700000 seconds
Frame Number: 3
Packet Length: 98 bytes
Capture Length: 98 bytes
Ethernet II, Src: 00:50:bf:75:16:95, Dst: 00:07:50:d0:9d:21
Destination: 00:07:50:d0:9d:21 (00:07:50:d0:9d:21)
Source: 00:50:bf:75:16:95 (00:50:bf:75:16:95)
Type: IP (0x0800)
Internet Protocol, Src Addr: 10.0.1.10 (10.0.1.10), Dst Addr: 10.0.2.10

(10.0.2.10)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 84
Identification: 0x0000 (0)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: ICMP (0x01)
Header checksum: 0x2396 (correct)
Source: 10.0.1.10 (10.0.1.10)
Destination: 10.0.2.10 (10.0.2.10)
Internet Control Message Protocol
Type: 8 (Echo (ping) request)
Code: 0
Checksum: 0x38a8 (correct)
Identifier: 0xaf08
Sequence number: 00:01
Data (56 bytes)
0000 26 e4 88 3f 69 27 0d 00 08 09 0a 0b 0c 0d 0e 0f &..?i'..........
0010 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f ................
0020 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f !"#$%&'()*+,-./
0030 30 31 32 33 34 35 36 37 01234567
Frame 4 (98 bytes on wire, 98 bytes captured)
Arrival Time: Aug 11, 2003 22:18:31.875124000
Time delta from previous packet: 1.012338000 seconds
Time relative to first packet: 1.013038000 seconds
Frame Number: 4
Packet Length: 98 bytes
Capture Length: 98 bytes

Ethernet II, Src: 00:50:bf:75:16:95, Dst: 00:07:50:d0:9d:21
Destination: 00:07:50:d0:9d:21 (00:07:50:d0:9d:21)
Source: 00:50:bf:75:16:95 (00:50:bf:75:16:95)
Type: IP (0x0800)
Internet Protocol, Src Addr: 10.0.1.10 (10.0.1.10), Dst Addr: 10.0.2.10

(10.0.2.10)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 84
Identification: 0x0000 (0)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: ICMP (0x01)
Header checksum: 0x2396 (correct)
Source: 10.0.1.10 (10.0.1.10)
Destination: 10.0.2.10 (10.0.2.10)
Internet Control Message Protocol
Type: 8 (Echo (ping) request)
Code: 0
Checksum: 0x3f74 (correct)
Identifier: 0xaf08
Sequence number: 00:02
Data (56 bytes)
0000 27 e4 88 3f 61 5a 0d 00 08 09 0a 0b 0c 0d 0e 0f '..?aZ..........
0010 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f ................
0020 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f !"#$%&'()*+,-./
0030 30 31 32 33 34 35 36 37 01234567
Frame 5 (98 bytes on wire, 98 bytes captured)
Arrival Time: Aug 11, 2003 22:18:31.877163000
Time delta from previous packet: 0.002039000 seconds
Time relative to first packet: 1.015077000 seconds
Frame Number: 5
Packet Length: 98 bytes
Capture Length: 98 bytes
Ethernet II, Src: 00:07:50:d0:9d:21, Dst: 00:50:bf:75:16:95
Destination: 00:50:bf:75:16:95 (00:50:bf:75:16:95)
Source: 00:07:50:d0:9d:21 (00:07:50:d0:9d:21)
Type: IP (0x0800)
Internet Protocol, Src Addr: 10.0.2.10 (10.0.2.10), Dst Addr: 10.0.1.10

(10.0.1.10)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0

.... ...0 = ECN-CE: 0
Total Length: 84
Identification: 0x7c19 (31769)
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 63
Protocol: ICMP (0x01)
Header checksum: 0xe87c (correct)
Source: 10.0.2.10 (10.0.2.10)
Destination: 10.0.1.10 (10.0.1.10)
Internet Control Message Protocol
Type: 0 (Echo (ping) reply)
Code: 0
Checksum: 0x4774 (correct)
Identifier: 0xaf08
Sequence number: 00:02
Data (56 bytes)
0000 27 e4 88 3f 61 5a 0d 00 08 09 0a 0b 0c 0d 0e 0f '..?aZ..........
0010 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f ................
0020 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f !"#$%&'()*+,-./
0030 30 31 32 33 34 35 36 37 01234567
Frame 6 (98 bytes on wire, 98 bytes captured)
Arrival Time: Aug 11, 2003 22:19:05.358288000
Time delta from previous packet: 33.481125000 seconds
Time relative to first packet: 34.496202000 seconds
Frame Number: 6
Packet Length: 98 bytes
Capture Length: 98 bytes
Ethernet II, Src: 00:50:bf:75:16:95, Dst: 00:07:50:d0:9d:21
Destination: 00:07:50:d0:9d:21 (00:07:50:d0:9d:21)
Source: 00:50:bf:75:16:95 (00:50:bf:75:16:95)
Type: IP (0x0800)
Internet Protocol, Src Addr: 10.0.1.10 (10.0.1.10), Dst Addr: 10.0.2.137

(10.0.2.137)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 84
Identification: 0x0000 (0)
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: ICMP (0x01)
Header checksum: 0x2317 (correct)