Wireshark-users: Re: [Wireshark-users] IP Conversation
From: Martin Visser <[email protected]>
Date: Fri, 11 Sep 2009 22:54:09 +1000
If there is a Quality of Service policy applied at the router it might also change the Type of Service (TOS) field, which usually is known as DiffServ Code Point now. Of course if the router is doing network address translation (NAT) it might even change IP addresses (and of course need to remember the mangling it has done to fix up packets coming in the reverse direction. It could fragment the packet if the MTU of the outgoing interface is smaller than the size of the incoming packet.

Finally any such changes will require a header checksum recalculation (including the TTL change).

So, potentially lots can be done to the packet as it passes through a router. However, your own statement would be pretty much how things normally happen.

Regards, Martin

[email protected]

On Fri, Sep 11, 2009 at 11:59 AM, <[email protected]> wrote:
How do IP packets change as they pass between 2 routers.  If  I mirrored the output port of each router and captured the conversation packets with Wireshark, would both captures look the same with the exception of the MAC address and the TTL value?
Sent via:    Wireshark-users mailing list <[email protected]>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:[email protected]?subject=unsubscribe