Subject: Re: Question on "identification" field of IP header

From: David Borman <[email-masked]>
Date: Fri, 13 Dec 2002 11:14:11 -0600 (CST)

Just a minor nit that I feel should be clarified:

> From: der Mouse <[email-masked]>
> Date: Fri, 13 Dec 2002 16:41:51 +0100 (CET)
> Subject: Re: Question on "identification" field of IP header
...
> Note that the portion of a packet returned in an ICMP does not include
> even the IP source and destination addresses; the identification value
> is almost the only value that can be relied upon to identify the
> original packet upon getting an ICMP....

Actually, ICMP packets are supposed to return the entire IP header
(including options) plus 64 bits of the IP data.  So, you should get
up to the TCP and UDP port numbers.  (RFC 792 explicitly states
that it assumes that higher level protocols have their port numbers
in the first 64 bits).

			-David Borman

---

From: Ramesh Shankar <[email-masked]>
Date: Fri, 13 Dec 2002 11:05:19 -0700

I would suspect that for the ICMP case, the IP ID wouldn't be too useful 
for the transport and above layers as these layers typically don't know 
(or care) about the ID in the IP header.

Even for the retransmit cases, typically new IDs are used and no attempt 
is made to reuse the ID with which the previously lost packet was sent.

Hoping that someone would clarify the purpose in life of the IP ID field 
if the don't fragment bit is set. One answer that Jamshid Mahdavi told 
me privately was that it would be useful at debugging time while looking 
at packet traces.

Thanks,

S.R.

-- 
-------------------------------------------------------------------------------
NOTICE: This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information meant for the sole use of the recipient(s) specified in the e-mail. Any unauthorized review, use, disclosure or distribution (including but not limited to: forwarding, replying to, or including recipients not included in the original e-mail) without the sender's prior approval is STRICTLY prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.
--------------------------------------------------------------------------------

---

From: der Mouse <[email-masked]>
Date: Fri, 13 Dec 2002 19:23:54 +0100 (CET)

>> Note that the portion of a packet returned in an ICMP does not
>> include even the IP source and destination addresses; [...]
> (including options) plus 64 bits of the IP data.

Duh.  You are, of course, correct.  I even went and checked 792 when I
wrote that; I don't know how I managed to misread it so egregiously.

My apologies to everyone for spreading misinformation.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B