ICMP 错误消息和生成它们的 IP 数据包之间的相关性答案

【问题标题】：Correlation between ICMP error messages and IP packets that generated themICMP 错误消息和生成它们的 IP 数据包之间的相关性
【发布时间】：2012-04-16 09:52:31
【问题描述】：

我需要发送一堆我确定会触发 ICMP TTL 过期错误消息的 IP 数据包。如何准确地将每条错误消息与生成它的数据包相关联？ ICMP 标头中的哪个字段用于此目的？

我是否应该在原始 IP 标头中使用一些自定义 ID 号，以便我可以知道哪个错误消息对应于哪个数据包？如果有，哪个领域最适合这个？

【问题讨论】：

标签： networking ip packet icmp ttl

【解决方案1】：

ICMP TTL Expired 消息的正文必须包含原始数据包的 IP 标头（包括源端口/目标端口）和原始标头之外的 64 位。

根据时间和该标头信息，您可以推导出哪个数据包触发了 TTL 过期消息。

我在下面包含一个由 NTP 数据包触发的示例...

更多详情请参阅RFC 792（第5页）。

ICMP TTL 过期消息

Ethernet II, Src: JuniperN_c3:a0:00 (b0:c6:9a:c3:a0:00), Dst: 78:2b:cb:37:4c:7a (78:2b:cb:37:4c:7a)
    Destination: 78:2b:cb:37:4c:7a (78:2b:cb:37:4c:7a)
        Address: 78:2b:cb:37:4c:7a (78:2b:cb:37:4c:7a)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: JuniperN_c3:a0:00 (b0:c6:9a:c3:a0:00)
        Address: JuniperN_c3:a0:00 (b0:c6:9a:c3:a0:00)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: 172.25.116.254 (172.25.116.254), Dst: 172.25.116.10 (172.25.116.10)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 56
    Identification: 0x86d7 (34519)
    Flags: 0x02 (Don't Fragment)
        0.. = Reserved bit: Not Set
        .1. = Don't fragment: Set
        ..0 = More fragments: Not Set
    Fragment offset: 0
    Time to live: 255
    Protocol: ICMP (0x01)
    Header checksum: 0xb3b1 [correct]
        [Good: True]
        [Bad : False]
    Source: 172.25.116.254 (172.25.116.254)
    Destination: 172.25.116.10 (172.25.116.10)
Internet Control Message Protocol
    Type: 11 (Time-to-live exceeded)
    Code: 0 (Time to live exceeded in transit)
    Checksum: 0x4613 [correct]
    Internet Protocol, Src: 172.25.116.10 (172.25.116.10), Dst: 172.25.0.11 (172.25.0.11)
        Version: 4
        Header length: 20 bytes
        Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
            0000 00.. = Differentiated Services Codepoint: Default (0x00)
            .... ..0. = ECN-Capable Transport (ECT): 0
            .... ...0 = ECN-CE: 0
        Total Length: 36
        Identification: 0x0001 (1)
        Flags: 0x00
            0.. = Reserved bit: Not Set
            .0. = Don't fragment: Not Set
            ..0 = More fragments: Not Set
        Fragment offset: 0
        Time to live: 0
            [Expert Info (Note/Sequence): "Time To Live" only 0]
                [Message: "Time To Live" only 0]
                [Severity level: Note]
                [Group: Sequence]
        Protocol: UDP (0x11)
        Header checksum: 0xee80 [correct]
            [Good: True]
            [Bad : False]
        Source: 172.25.116.10 (172.25.116.10)
        Destination: 172.25.0.11 (172.25.0.11)
    User Datagram Protocol, Src Port: telindus (1728), Dst Port: ntp (123)
        Source port: telindus (1728)
        Destination port: ntp (123)
        Length: 16
        Checksum: 0xa7a1 [unchecked, not all data available]
            [Good Checksum: False]
            [Bad Checksum: False]

【讨论】：

好的，所以我应该跟踪每个数据包的每个标头和有效负载的前 8 个字节，对吗？搜索的时候也不算太快，但如果没有别的办法，那我就处理了。