I have been largely looking at packet captures for tcp streams. today I noticed that I was oddly getting icmp ttl exceeded messages back on the network from various devices on the path when I wasn't even pinging... I have to admit parsing icmp is not in my skillset. Is there useful information in the icmp messages in this capture? http://snapon.lab.bufferbloat.net/~d/ttl_exceeded.cap -- Dave Täht Fixing bufferbloat with cerowrt: http://www.teklibre.com/cerowrt/subscribe.html