Wireshark-users: Re: [Wireshark-users] ICMP packets with two pairs of source and destination ip a
nangergong <nangergong@...> writes:
> if a packet is with a src ip A and a dst ip B while with a src ip B and a dst
ip A, what is the real direction? from A to B or from B to A?I get confused.
Direction is always from src to dst.
Is this is an ICMP destination unreachable packet, by any chance? Assuming so,
consider the following example:
----------------------------------------------------------------------
Frame 1: 48 bytes on wire (384 bits), 48 bytes captured (384 bits)
Ethernet II, Src: 00:26:b9:b3:ce:7a, Dst: 00:90:27:85:cf:01
Internet Protocol Version 4, Src: 192.168.1.103, Dst: 192.168.1.204
User Datagram Protocol, Src Port: 12345, Dst Port: 54321
Data (6 bytes)
----------------------------------------------------------------------
Frame 2: 76 bytes on wire (608 bits), 76 bytes captured (608 bits)
Ethernet II, Src: 00:90:27:85:cf:01, Dst: 00:26:b9:b3:ce:7a
Internet Protocol Version 4, Src: 192.168.1.204, Dst: 192.168.1.103
Internet Control Message Protocol
Type: 3 (Destination unreachable)
Code: 3 (Port unreachable)
Checksum: 0x7480 [correct]
Internet Protocol Version 4, Src: 192.168.1.103, Dst: 192.168.1.204
User Datagram Protocol, Src Port: 12345, Dst Port: 54321
Data (6 bytes)
----------------------------------------------------------------------
In frame 1, host 192.168.1.103 sends a UDP packet to host 192.168.1.204.
In frame 2, host 192.168.1.204 informs host 192.168.1.103 that the packet is
undeliverable because the port is unreachable and returns the original IP header
from frame 1 and up to 8 bytes of payload per RFC792 (in this case, there's only
6 bytes of payload so the entire payload is returned) back to host
192.168.1.103.
So ...
Frame 1: 192.168.1.103 -> 192.168.1.204
Frame 2: 192.168.1.204 -> 192.168.1.103
Hope it helps.
- Chris
See also:
http://tools.ietf.org/html/rfc792
http://en.wikipedia.org/wiki/ICMP_Destination_Unreachable
