Wireshark · Wireshark-users: Re: [Wireshark-users] IP Conversation

[Martin Visser <martinvisser99@xxxxxxxxx>]

If there is a Quality of Service policy applied at the router it might also change the Type of Service (TOS) field, which usually is known as DiffServ Code Point now. Of course if the router is doing network address translation (NAT) it might even change IP addresses (and of course need to remember the mangling it has done to fix up packets coming in the reverse direction. It could fragment the packet if the MTU of the outgoing interface is smaller than the size of the incoming packet.

Finally any such changes will require a header checksum recalculation (including the TTL change).

So, potentially lots can be done to the packet as it passes through a router. However, your own statement would be pretty much how things normally happen.

Regards, Martin

MartinVisser99@xxxxxxxxx

On Fri, Sep 11, 2009 at 11:59 AM, <rkruz@xxxxxxx> wrote:

How do IP packets change as they pass between 2 routers.  If  I mirrored the output port of each router and captured the conversation packets with Wireshark, would both captures look the same with the exception of the MAC address and the TTL value?
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe