Wireshark · Ethereal-users: [Ethereal-users] Re: ICMP

[ronnie sahlberg <ronniesahlberg@xxxxxxxxx>]

On Tue, 22 Mar 2005 15:47:14 +0100, LEGO <luis.ontanon@xxxxxxxxx> wrote:
> On Tue, 22 Mar 2005 15:33:16 +0100, julien.leproust@xxxxxxxx
> <julien.leproust@xxxxxxxx> wrote:
> > Bob Snyder a écrit :
> [snip]
> > eth:ip:icmp:ip:udp:gtp:ip:udp:ppp:ip:udp and you do want a reliable
> > filtering system to debug this)
> 
> Just a reminder:
> 
> ICMP messages carry only the first 64 bits (eight octets) of the
> payload of the errored ip packet. i.e. just enough for the UDP header.

ICMP mesages carry at least 64 bits of the header for the protocol above IP.
Many implementations do provide a lot more than 64 bits, some fills
the ICMP header up to the entire MTU.

The standard only requires the first 64 bits and some implementations
only provide this. Many supply much more than 64 bits.