2

Considering a loop topology between a few routers with a host connected to one of them, when it's default routing directs to the cycle.

Even when observing Wireshark, how can we know its the same packet and not different ones?

The only field that was the same was the ipV4 checksum, which seems to me a bit unintuitive as the header checksum differed. Why wouldn't they be the same?

Is there another, better way to deduce that a looped packet is indeed looped and the same packet? A thing I noticed was that the difference between all the TTL's was the cycle's length, but it's not concrete, just a guess from an observer's perspective. And if they are the same, what makes them different apart from TTLs after each cycle?

Improve this question
2
  • Assuming the system is sterile, and doesn't have the possibility for causing errors in packets, you could compare TCP/UDP checksums - but even this is not 100% certain. One checksum value can represent different sets of data. I would add some large (depends on how reliable you want this to be) MD5 hash function field in the application itself and compare that.
    – manish ma
    May 23, 2022 at 4:26
  • 1
    ipv4 checksum is the same, because checksum is calculated over fields that are not supposed to be changed during forwarding.
    – Effie
    May 23, 2022 at 6:53

2 Answers 2

Reset to default
2

There is nothing in the IPv4 header that enables you to identify duplicates. A packet is a duplicate when it matches a previous packet in entirety, header (apart from TTL and checksum) and payload, and the source has only send one such packet.

As @manishma has pointed out, you would need to hash each packet, store the hashes for a certain time and check for matches between them. If there's in-path fragmentation you'd even need to reassemble fragments before hashing. Of course, packets with very low TTL values are a clear warning sign.

A routing loop is most easily detected by using traceroute-type probes - a series of packets with TTL increasing from 0 - and then analyzing the sources of the ICMP time exceeded messages.

Improve this answer
2

This is (one of the things) that the ID field in the IP packet is for. It should unique identify an IP packet for a particular source, destination, and protocol for the lifetime that a datagram is expected to circulate.

https://datatracker.ietf.org/doc/html/rfc6864

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.