Wireshark · Ethereal-users: Re: [Ethereal-users] Re: ICMP

[Joerg Mayer <jmayer@xxxxxxxxx>]

On Tue, Mar 22, 2005 at 02:53:35PM +0100, Olaf van der Spek wrote:
> You didn't ask for 'udp directly on top of ip', but just for udp.

Exactly. If you only want "udp directly on top of ip" then you have to
specify this. Otherwise, you wouldn't be seeing udp inside gre tunnels
either - and this is much more non-inuitive than the case here. The
non intuitive thing in this special case is, that it's not really udp
traffic, it's just a status message being sent back that contains part
of a problematic packet for informative purposes. So in this specific
case our semantics may be non-intuitive, as it isn't a "normal" udp
packet.

 ciao
    Joerg
-- 
Joerg Mayer                                           <jmayer@xxxxxxxxx>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.