ICMP echo request needs to be sent from WS0 to 10.X.2.1
WS0 does not have a route that includes 10.X.2.1, so it 
uses the default route (10.0.0.0/8) and the next hop is
ip ZZ.ZZ.ZZ.ZZ.

WS0 doesn't have anything in its ARP cache so it sends
an arp request asking for the mac address of (something).

(something) sends an arp reply with its mac address. 

WS0 then sends an ICMP echo request to 10.X.2.1

	src IP = XX.XX.XX.XX
	dst IP = XX.XX.XX.XX
	src MAC = yy:yy:yy:yy:yy:yy
	dst MAC = yy:yy:yy:yy:yy:yy

(something) does (something) and also (something)
It sends two packets out one to (somewhere), it is
a (packet type)

	src IP = XX.XX.XX.XX
	dst IP = XX.XX.XX.XX
	src MAC = yy:yy:yy:yy:yy:yy
	dst MAC = yy:yy:yy:yy:yy:yy

and the other to (somewhere else) which is
(packet type)

	src IP = XX.XX.XX.XX
	dst IP = XX.XX.XX.XX
	src MAC = yy:yy:yy:yy:yy:yy
	dst MAC = yy:yy:yy:yy:yy:yy


Continue and discuss the sequence for the echo reply 
sent back and then continue and discuss what changes for
subsequent packets. Remember it may take a couple of 
packets before the redirect takes effect.

Be sure to include src IP and dst IP and src MAC 
and dst MAC for all *IP* packets. 

Ignore any packets of type LOOP or CDP that you may 
see in the pcap file.