2

A week ago, after opening wireshark, i was surprised by seing a storm of ICMP packets from different IP addresses. While deep analysing of thoses packets, i noticed that those ICMP packets contains IPv4 headers and UDP/TCP headers. It seems like port scanning. I spent a lot of time searching of an answer of how this is possible but i didnt find anything. I know that there is an attack named ICMP tunneling but i dont think that there is some tunneling in this case.

IPv4 & TCP over ICMP

Here is some other pictures:

https://ibb.co/TvmZS6Y
https://ibb.co/FnpsVVR
https://ibb.co/rMqwgyv
https://ibb.co/pZPXTgC

1 Answer 1

2

An ICMP error message will contain the IP header and first 64 bits (eight octets) of the original data. See RFC 792, Internet Message Control Protocol:

Internet Header + 64 bits of Data Datagram

The internet header plus the first 64 bits of the original datagram's data. This data is used by the host to match the message to the appropriate process. If a higher level protocol uses port numbers, they are assumed to be in the first 64 data bits of the original datagram's data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.