1

TCP SYN for traceroute

TCP-SYN Total length 58B - 14B eth - 20B IP - 24B TCP

ICMP TTL-exceeded reply with Length field in ICMP header??

ICMP header shows Length 243 [Length of original datagram: 972]

Not sure how this works, as I sent a TCP-SYN of 58 Bytes frame. Please explain

2
  • ICMP and TCP are two separate protocols. You cannot have both in the same packet payload. ICMP would be a reply for the TCP segment. – Ron Maupin Jun 3 '16 at 20:21
  • ICMP errors return as much of the original packet as practical. The part in brackets is not part of the packet, but something wireshark is providing for you. (incorrectly, it would appear.) – Ricky Jun 3 '16 at 20:54
1

If the "Length" field in the ICMP header has a value of 243, then the host sending it thought the original datagram was 243*4 = 972 bytes long. Wireshark is correctly reporting the purported length of the original datagram, so either 1) the host sending the ICMP packet didn't correctly calculate the length or 2) the packet really did have a length of 972 bytes.

What does the total length field of the IP header preceding the TCP header show? If you didn't have any IP options, it should specified a length of 20+24 = 44 (20 for the IPv4 header, 24 for the TCP header with the MSS option); the length field in question is in 4-byte units, so it should have been 11. If it didn't have a value of 11, but instead had a value of 243, that's a bug in the code that constructed the IPv4 header for the TCP SYN segment.

2
  • The length was 44 Bytes. Thanks for the clarification. – Kaushal Deodhar Jun 5 '16 at 21:33
  • 1
    I.e., if you open up the "Internet Protocol, Version 4, ..." line right above the "Transmission Control Protocol..." line (not the one above the "Internet Control Message Protocol" line!), and look at the "Total Length:" line in the section you opened up, it said 44 (i.e., a numerical value of 11)? If so, then whatever program sent out that ICMP message was buggy. – user2373 Jun 5 '16 at 22:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.