Michael C. Toren on 28 Oct 2004 12:18:02 -0000

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [tcptra-dev] Different ICMP-ReturnCodes showing in tcpdump, but not in tcptraceroute

On Wed, Oct 27, 2004 at 10:45:22AM +0200, Thomas Springer wrote:
> looking at a tcpdump, i noticed, that the icmp-codes differ 
> sometimes between icmp48 and icmp36 (standard seems to be icmp36):


> 09:38:03.656062 IP tbr1-cl1.cgcil.ip.att.net > xx.xx.192.133: icmp 
> 48: time exceeded in-transit

Yes, as Richard pointed out, "48" and "36" isn't referring to the ICMP
type -- in this case, the ICMP type was 11 ("time exceeded") and the
ICMP code was 0 ("in-transit").  tcpdump already expanded these values
to their proper nouns for you.


perl -e'$u="\4\5\6";sub H{8*($_[1]%79)+($_[0]%8)}sub G{vec$u,H(@_),1}sub S{vec
($n,H(@_),1)=$_[2]}$_=q^{P`clear`;for$iX){PG($iY)?"O":" "forX8);P"\n"}for$iX){
forX8){$c=scalar grep{G@$_}[$i-1Y-1Z-1YZ-1Y+1ZY-1ZY+1Z+1Y-1Z+1YZ+1Y+1];S$iY,G(
/,\$_/xg;s/X/(0..7/g;s/P/print+/g;eval' #     Michael C. Toren <mct@toren.net>

tcptraceroute-dev mailing list