Question

我需要发送一堆IP数据包，我肯定会触发ICMP TTL过期的错误消息。我如何将每条错误消息与生成它的数据包关联起来？ ICMP头中的哪个字段用于此目的？

我是否应该在原始IP标头中使用一些自定义ID号，以便我可以告诉哪个错误消息对应哪个数据包？如果是这样，哪个领域最适合这个？

Answer 1

ICMP TTL Expired消息的主体必须包含原始数据包的IP头（包括源端口/目标端口）和原始头之外的64位。

根据时间和标题信息，您可以导出哪个数据包触发了TTL过期的消息。

我在下面包含一个由NTP数据包触发的示例...

有关详细信息，请参阅RFC 792（第5页）。

ICMP TTL过期消息

Ethernet II, Src: JuniperN_c3:a0:00 (b0:c6:9a:c3:a0:00), Dst: 78:2b:cb:37:4c:7a (78:2b:cb:37:4c:7a)
    Destination: 78:2b:cb:37:4c:7a (78:2b:cb:37:4c:7a)
        Address: 78:2b:cb:37:4c:7a (78:2b:cb:37:4c:7a)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: JuniperN_c3:a0:00 (b0:c6:9a:c3:a0:00)
        Address: JuniperN_c3:a0:00 (b0:c6:9a:c3:a0:00)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: 172.25.116.254 (172.25.116.254), Dst: 172.25.116.10 (172.25.116.10)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 56
    Identification: 0x86d7 (34519)
    Flags: 0x02 (Don't Fragment)
        0.. = Reserved bit: Not Set
        .1. = Don't fragment: Set
        ..0 = More fragments: Not Set
    Fragment offset: 0
    Time to live: 255
    Protocol: ICMP (0x01)
    Header checksum: 0xb3b1 [correct]
        [Good: True]
        [Bad : False]
    Source: 172.25.116.254 (172.25.116.254)
    Destination: 172.25.116.10 (172.25.116.10)
Internet Control Message Protocol
    Type: 11 (Time-to-live exceeded)
    Code: 0 (Time to live exceeded in transit)
    Checksum: 0x4613 [correct]
    Internet Protocol, Src: 172.25.116.10 (172.25.116.10), Dst: 172.25.0.11 (172.25.0.11)
        Version: 4
        Header length: 20 bytes
        Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
            0000 00.. = Differentiated Services Codepoint: Default (0x00)
            .... ..0. = ECN-Capable Transport (ECT): 0
            .... ...0 = ECN-CE: 0
        Total Length: 36
        Identification: 0x0001 (1)
        Flags: 0x00
            0.. = Reserved bit: Not Set
            .0. = Don't fragment: Not Set
            ..0 = More fragments: Not Set
        Fragment offset: 0
        Time to live: 0
            [Expert Info (Note/Sequence): "Time To Live" only 0]
                [Message: "Time To Live" only 0]
                [Severity level: Note]
                [Group: Sequence]
        Protocol: UDP (0x11)
        Header checksum: 0xee80 [correct]
            [Good: True]
            [Bad : False]
        Source: 172.25.116.10 (172.25.116.10)
        Destination: 172.25.0.11 (172.25.0.11)
    User Datagram Protocol, Src Port: telindus (1728), Dst Port: ntp (123)
        Source port: telindus (1728)
        Destination port: ntp (123)
        Length: 16
        Checksum: 0xa7a1 [unchecked, not all data available]
            [Good Checksum: False]
            [Bad Checksum: False]

ICMP错误消息与生成它们的IP数据包之间的关联

1 个答案:

ICMP TTL过期消息