1

Currently working on a Go based NAT router and when translating ICMP traffic and am seeing some interesting behavior.

The clients request is forwarded to the server, the server keeps track of the internal IP and the clients ICMP ID, uses an open ICMP ID from the server, changes fields in the packet and forwards it to the external address (in this case 8.8.8.8).

When the server receives the response it looks up what internal IP, MAC, and ICMP ID to the external ICMP packet ID and forwards it back to the client.

I am likely missing something basic because I am too close to the issue but any help would be appreciated. If the packet is malformed in some way that I have not recognized then I will be able to adjust the code accordingly.

Request sent from client Request sent from client

Reply Sent from server after receiving outside reply

Reply Sent from server

Improve this question
13
  • Unfortunately, your question is off-topic here. You can ask about programming on Stack Overflow, where there are many network-savvy programmers. The only thing I can see is that your return IP packet may have a bad checksum, and that would cause the destination to drop it (technically, the router should not forward a packet with a bad checksum)..
    – Ron Maupin ♦
    Jan 29, 2020 at 14:38
  • My question is in regards to purely the pcap supplied I was simply giving context. The checksum should be recalculated on each packet being sent so that should not be an issue. If you would like me to move the topic I can but I am asking a networking question currently not a programming question.
    – toothflower
    Jan 29, 2020 at 14:50
  • Unfortunately, your network device (a router you are building) is off-topic here, as are questions about what your host/server does. You really will not find anyone here to answer the question beyond what I have already said in my comments, and the "should" you postulate for the recalculation cannot be determined as you have the validation disabled in the second screenshot. In any case, using an on-topic, enterprise-grade router would perform properly unless there is an off-topic host problem.
    – Ron Maupin ♦
    Jan 29, 2020 at 14:56
  • I am only looking for a second opinion on a PCAP sample provided nothing else, if you would like me to state that explicitly I can but I don't understand why the pure mention of it being being sent from a home-brewed product is action for removing. I am not asking on how to fix the server or the host in any way, purely if there is a red flag in the PCAPs provided. If you would like to continue the conversation regarding the checksum portion of my network question then please unlock the post as it is a networking question and answer.
    – toothflower
    Jan 29, 2020 at 15:07
  • I am simply trying to point you to a place where you will get some action on your question. Your question will just languish here, and nobody will answer it. That is not what you want, and it is not what the community here wants. Remember that, "NE is a site for to ask and provide answers about professionally managed networks in a business environment."
    – Ron Maupin ♦
    Jan 29, 2020 at 15:10

0

Reset to default

Browse other questions tagged or ask your own question.