TCP SYN for traceroute
ICMP header shows Length 243 [Length of original datagram: 972]
Not sure how this works, as I sent a TCP-SYN of 58 Bytes frame. Please explain
-
ICMP and TCP are two separate protocols. You cannot have both in the same packet payload. ICMP would be a reply for the TCP segment.– Ron Maupin ♦Commented Jun 3, 2016 at 20:21
-
ICMP errors return as much of the original packet as practical. The part in brackets is not part of the packet, but something wireshark is providing for you. (incorrectly, it would appear.)– RickyCommented Jun 3, 2016 at 20:54
Add a comment
|
1 Answer
If the "Length" field in the ICMP header has a value of 243, then the host sending it thought the original datagram was 243*4 = 972 bytes long. Wireshark is correctly reporting the purported length of the original datagram, so either 1) the host sending the ICMP packet didn't correctly calculate the length or 2) the packet really did have a length of 972 bytes.
What does the total length field of the IP header preceding the TCP header show? If you didn't have any IP options, it should specified a length of 20+24 = 44 (20 for the IPv4 header, 24 for the TCP header with the MSS option); the length field in question is in 4-byte units, so it should have been 11. If it didn't have a value of 11, but instead had a value of 243, that's a bug in the code that constructed the IPv4 header for the TCP SYN segment.
-
The length was 44 Bytes. Thanks for the clarification. Commented Jun 5, 2016 at 21:33
-
1I.e., if you open up the "Internet Protocol, Version 4, ..." line right above the "Transmission Control Protocol..." line (not the one above the "Internet Control Message Protocol" line!), and look at the "Total Length:" line in the section you opened up, it said 44 (i.e., a numerical value of 11)? If so, then whatever program sent out that ICMP message was buggy.– user2373Commented Jun 5, 2016 at 22:45