TCP SYN for traceroute
ICMP header shows Length 243 [Length of original datagram: 972]
Not sure how this works, as I sent a TCP-SYN of 58 Bytes frame. Please explain
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.Sign up to join this community
If the "Length" field in the ICMP header has a value of 243, then the host sending it thought the original datagram was 243*4 = 972 bytes long. Wireshark is correctly reporting the purported length of the original datagram, so either 1) the host sending the ICMP packet didn't correctly calculate the length or 2) the packet really did have a length of 972 bytes.
What does the total length field of the IP header preceding the TCP header show? If you didn't have any IP options, it should specified a length of 20+24 = 44 (20 for the IPv4 header, 24 for the TCP header with the MSS option); the length field in question is in 4-byte units, so it should have been 11. If it didn't have a value of 11, but instead had a value of 243, that's a bug in the code that constructed the IPv4 header for the TCP SYN segment.