Overview

It didn't take long to figure out what the SNOOPER laptop was up to. The Netasyst Sniffer's Summary window in Screen Capture 12.1 shows that the next operation initiated by SNOOPER is and ICMP Echo, better known to all of us as a PING.

Screen Capture 12.1: It looks like SNOOPER needed an AirDrop-P hardware address to get on with the PING operation. Although you see a pair of ICMP Echo request and a pair of ICMP Echo reply frames, only a single ICMP Echo request/reply exchange occurred between the physical source and destination stations. The first ICMP Echo request message is sent to the AP (Frame 35) and the second ICMP Echo request message is the AP redirecting the ICMP Echo request message to the AirDrop-P module. The same process holds for the ICMP Echo reply transmitted by the AirDrop-P module in Frame 39 and echoed by the AP in Frame 41.

ICMP messages serve many purposes. For instance, we're using ICMP to echo a packet from one host to another and back. An ICMP message may also be sent when a datagram cannot reach its destination. ICMP messages are primarily used to provide feedback about problems that exist with datagrams in the communication environment. The only thing an ICMP message can't do is tell on itself when it's bad.

A "PING" is really an application that issues an ICMP echo request packet. Basically a ping sends some data to a remote host and expects the remote host...