Wireshark · Ethereal-users: Re: [Ethereal-users] Re: Ethereal-users digest, Vol 1 #1032 - 4 msgs

["Martin Regner" <martin.regner@xxxxxxxxx>]

Antonio Gutierrez wrote:

>Hi,
>is it possiable to have a ICMP Packet have tow Source IP in the same
>Packet? this is Destination Unreachable.
> 


An ICMP message of type "Destination Unreachable" contains the IP-header and at least a part of the IP payload
of the packet that resulted in "Destination Unreachable", so there is normally one IP source address for the ICMP
message and then also the IP source address of the original IP message (I think it might be even more than those 
if there is IP tunneling or similar).

Both the display filters below will filter out the same IPv6 ICMP packet further down 

ipv6.src == 3ffe:507:0:1:200:86ff:fe05:80da

ipv6.src == 3ffe:501:4819::42

I'm not sure if that answered what you wanted to know.

Frame 137 (300 bytes on wire, 300 bytes captured)
    Arrival Time: Mar 11, 1999 14:46:01.962117000
    Time delta from previous packet: 0.001071000 seconds
    Time relative to first packet: 59.820360000 seconds
    Frame Number: 137
    Packet Length: 300 bytes
    Capture Length: 300 bytes
    File Offset: 24436 (0x5f74)
Ethernet II, Src: 00:00:86:05:80:da, Dst: 00:60:97:07:69:ea
    Destination: 00:60:97:07:69:ea (00:60:97:07:69:ea)
    Source: 00:00:86:05:80:da (00:00:86:05:80:da)
    Type: IPv6 (0x86dd)
Internet Protocol Version 6
    Version: 6
    Traffic class: 0x00
    Flowlabel: 0x00000
    Payload length: 246
    Next header: ICMPv6 (0x3a)
    Hop limit: 64
    Source address: 3ffe:507:0:1:200:86ff:fe05:80da
    Destination address: 3ffe:501:4819::42
Internet Control Message Protocol v6
    Type: 1 (Unreachable)
    Code: 4 (Port unreachable)
    Checksum: 0xb1b5 (correct)
    Internet Protocol Version 6
        Version: 6
        Traffic class: 0x00
        Flowlabel: 0x00000
        Payload length: 198
        Next header: UDP (0x11)
        Hop limit: 230
        Source address: 3ffe:501:4819::42
        Destination address: 3ffe:507:0:1:200:86ff:fe05:80da
    User Datagram Protocol, Src Port: 53 (53), Dst Port: 2410 (2410)
        Source port: 53 (53)
        Destination port: 2410 (2410)
        Length: 198
        Checksum: 0x1e36 (correct)
    Domain Name System (response)
        Transaction ID: 0x5c74
        Flags: 0x8580 (Standard query response, No error)
            1... .... .... .... = Response: Message is a response
            .000 0... .... .... = Opcode: Standard query (0)
            .... .1.. .... .... = Authoritative: Server is an authority for domain
            .... ..0. .... .... = Truncated: Message is not truncated
            .... ...1 .... .... = Recursion desired: Do query recursively
            .... .... 1... .... = Recursion available: Server can do recursive queries
            .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
            .... .... .... 0000 = Reply code: No error (0)
        Questions: 1
        Answer RRs: 1
        Authority RRs: 2
        Additional RRs: 3
        Queries
            sh1.iijlab.net: type AAAA, class inet
                Name: sh1.iijlab.net
                Type: IPv6 address
                Class: inet
        Answers
            sh1.iijlab.net: type AAAA, class inet, addr 3ffe:507:0:1:260:97ff:fe07:69ea
                Name: sh1.iijlab.net
                Type: IPv6 address
                Class: inet
                Time to live: 1 hour
                Data length: 16
                Addr: 3ffe:507:0:1:260:97ff:fe07:69ea
        Authoritative nameservers
            iijlab.net: type NS, class inet, ns sh1.iijlab.net
                Name: iijlab.net
                Type: Authoritative name server
                Class: inet
                Time to live: 1 hour
                Data length: 16
                Name server: sh1.iijlab.net
            iijlab.net: type NS, class inet, ns dns0.iij.ad.jp
                Name: iijlab.net
                Type: Authoritative name server
                Class: inet
                Time to live: 1 hour
                Data length: 16
                Name server: dns0.iij.ad.jp
        Additional records
            sh1.iijlab.net: type A, class inet, addr 202.232.15.98
                Name: sh1.iijlab.net
                Type: Host address
                Class: inet
                Time to live: 1 hour
                Data length: 4
                Addr: 202.232.15.98
            sh1.iijlab.net: type AAAA, class inet, addr 3ffe:507:0:1:260:97ff:fe07:69ea
                Name: sh1.iijlab.net
                Type: IPv6 address
                Class: inet
                Time to live: 1 hour
                Data length: 16
                Addr: 3ffe:507:0:1:260:97ff:fe07:69ea
            dns0.iij.ad.jp: type A, class inet, addr 202.232.2.44
                Name: dns0.iij.ad.jp
                Type: Host address
                Class: inet
                Time to live: 21 hours, 38 minutes, 23 seconds
                Data length: 4
                Addr: 202.232.2.44