On Thu, 30 Aug 2001, gmarran wrote:
> In the format of the ICMP Destination Unreachable Message as given in
> RFC 792 [http://www.ietf.org/rfc/rfc0792.txt] the data portion of the
> packet is meant to contain only the original IP header + 64 bits of the
> original data datagram. However, packet analysis of an ICMP destination
> unreachable message returned from a gateway running Redhat Linux 7.0
> (kernel 2.2.16-22) gives a data portion of the packet containing the
> original IP header + 44*8 bits. This gives it as including the IP
> header, TCP header + TCP data portion + 18 bytes of garbage.
> If you cannot help but know someone who can, please forward this message
> to them, or send me their e-mail address. Following is the sniffed
> packet and a detailed analysis of it.
This is intentional; 64 bits is nowhere enough to identify the offending
packet properly. Therefore, with current link speeds, there's no harm in
attaching "everything you know" to the ICMP message.
--
Pekka Savola "Tell me of difficulties surmounted,
Netcore Oy not those you stumble over and fall"
Systems. Networks. Security. -- Robert Jordan: A Crown of Swords
|