Resolution of ICMP error responses

In some ICMP applications, we will find some ICMP error response problems. How can this problem be solved? Here we will introduce the specific content of Sniffer packet capture to analyze ICMP error responses.

An unopened port from 192.168.1.2telnet192.168.1.1

The returned port cannot reach the ICMP error and data frame is returned. It can be seen that the four bytes at the end of the Ethernet frame are 70 bytes in total.

Ethernet frame encapsulation of the IP-ICMP information format:

Ethernet frame header (14 bytes) --- IP packet header (20 bytes) -- {ICMP header (8 bytes) --- [original IP packet header with errors (20 bytes) -- the first 8 bytes of data in the original IP address]}

Note: {} indicates the IP address followed by the IP address data packet.

[] Indicates the ICMP packet followed by the ICMP Header

For more information, see Chapter 6

From here, we can see the specific handling details of the ICMP error response. It also includes some analysis of ICMP error responses.