Wireshark-users: Re: [Wireshark-users] IP Conversation
: Martin Visser <martinvisser99@xxxxxxxxx
: Fri, 11 Sep 2009 22:54:09 +1000
If there is a Quality of Service policy applied at the router it might also change the Type of Service (TOS) field, which usually is known as DiffServ Code Point now. Of course if the router is doing network address translation (NAT) it might even change IP addresses (and of course need to remember the mangling it has done to fix up packets coming in the reverse direction. It could fragment the packet if the MTU of the outgoing interface is smaller than the size of the incoming packet.
Finally any such changes will require a header checksum recalculation (including the TTL change).
So, potentially lots can be done to the packet as it passes through a router. However, your own statement would be pretty much how things normally happen.