Does there exist a difference between ICMP Destination Host Unreachable Message from MacOS/IOS and from Windows/Ubuntu? [closed]

Question

Information

I have recently been learning networking programming with Python, and I am now building a host scanner utilizing the ICMP Destination Unreachable Message.

Indeed, I have partially realized it. I can identify all the Windows/Linux/Android systems that connect to the networks at my home, but the problem is that:

I could not use the same way to find all the hosts with MacOS and IOS systems.

My Code

Here following is the main part which I used to decide if there exists a host: I have sent a message "PYTHONRULES!" to a port to every possible IP in my IP subnet.

And my result is the following:

But, in fact, at my room I have connected the wifi with an iPhone, a MBP and an Ubuntu(using the bridged network with VirtualBox).
I have checked each devices with its ip,

1. iPhone: 192.168.0.4
2. MBP: 192.168.0.2
3. Ubuntu: 192.168.0.21
4. DNS Server: 192.168.0.1

Easy to see, the problem exists.

What I Have Done

• I have directly checked the returned ICMP message from MBP to avoid the situation that the port is indeed active. the return ICMP type and code both equal to 3(That is Destination Host Unreachable)
• I have then checked the length of each of the returned messages. Here the difference comes:
  • The length of returned message from Ubuntu is 68 bytes, while the length of that from MBP is 56 bytes.
  • I have also tried in a networks with Windows systems which also returned a message of 68 bytes as the Ubuntu.
• I have searched through the Google about the phenomena, but could not find detailed explanation.

• I have searched through the Google about the format of ICMP Destination Unreachable Message, which states as

  IP Header(20 bytes) + ICMP Header(8 bytes) + Original IP Header(20 bytes) + First 8 bytes of the original message(8 bytes)(ps: I supposed this to be the UDP header here)

  Which is equal to the length of what returned from MBP, 56 bytes. So, definitely the more 12 bytes from the Ubuntu is the length of the message I have sent and I actually used this information to make sure that the returned message is a response to what I sent.

Questions

As a result, here come my questions,

1. If I am not misunderstood, there does exist a difference between ICMP Destination Host Unreachable Message from MacOS/IOS and Windows?? Why???

2. And if I want to use the same strategy to decide if there is a host, how could I modify my codes and make sure that returned message is a response to what I have sent for every systems(windows, MacOS/IOS and Linux).

Answer 1

What you are seeing is the difference between older and newer versions of the ICMP standard. The original specification stated that the header + 8 bytes (64 octets) must be included, but RFC 1812 states:

Historically, every ICMP error message has included the Internet header and at least the first 8 data bytes of the datagram that triggered the error. This is no longer adequate, due to the use of IP-in-IP tunneling and other technologies. Therefore, the ICMP datagram SHOULD contain as much of the original datagram as possible without the length of the ICMP datagram exceeding 576 bytes.

Apparently IOS and Mac OS use the older specification which doesn't include anything beyond your UDP header. Your code assumes that the last 12 bytes of the ICMP error is your magic_message, which only happens when the other device implements the revised RFC 1812 definition.