From: Ketan Kulkarni <ketkulka@gmail.com>
To: Dave Taht <dave.taht@gmail.com>
Cc: cerowrt-devel@lists.bufferbloat.net
Subject: Re: [Cerowrt-devel] ping icmp ttl exceeded
Date: Mon, 04 Feb 2013 07:33:31 -0000 [thread overview]
Message-ID: <CAD6NSj5ZPr1yz9FqnyusicqsdM42itc+HGqZ-1-EZpy0onf19g@mail.gmail.com> (raw)
In-Reply-To: <CAA93jw6JDTQP6b6hqVgHbOv5YcALQ7a0jd9DnEOoNGb-cSE5ww@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 1587 bytes --]
Hi Dave,
The TTL is decremented by 1 on every router. If it reaches 0, the pkt
is dropped and ICMP ttl exceeded is sent to the sender with icmp body
= first few bytes of the packet which caused this error.
Looks like, for every new Echo Req, ip ttl is set to 1. The next
router decrements it and send ICMP ttl exceeded back.
So 172.20.26.17 send Echo Req to 172.20.0.1 with ttl=1.
172.20.26.1 (probably your next router) decrements and sends ICMP TTL
exceeded to 172.20.26.17 (probably your client)
For the next request, ttl=2 and this time 172.20.26.17 (next to next
router) send ttl exceeded.
This is happening till ttl=6 at which the Echo Req is successful.
Probably this is the behaviour of ping cmd used with -R (record route)
option enabled.
Attached jpg for reference.
-Ketan
On Mon, Feb 4, 2013 at 12:40 PM, Dave Taht <dave.taht@gmail.com> wrote:
> I have been largely looking at packet captures for tcp streams. today I
> noticed that I was oddly getting icmp ttl exceeded messages back on the
> network from various devices on the path when I wasn't even pinging...
>
> I have to admit parsing icmp is not in my skillset. Is there useful
> information in the icmp messages in this capture?
>
> http://snapon.lab.bufferbloat.net/~d/ttl_exceeded.cap
>
> --
> Dave Täht
>
> Fixing bufferbloat with cerowrt:
> http://www.teklibre.com/cerowrt/subscribe.html
> _______________________________________________
> Cerowrt-devel mailing list
> Cerowrt-devel@lists.bufferbloat.net
> https://lists.bufferbloat.net/listinfo/cerowrt-devel
>
[-- Attachment #2: icmp_ttl_exceed.JPG --]
[-- Type: image/jpeg, Size: 319527 bytes --]
next prev parent reply other threads:[~2013-02-04 7:33 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-02-04 7:10 Dave Taht
2013-02-04 7:33 ` Ketan Kulkarni [this message]
2013-02-04 7:34 ` Ketan Kulkarni
2013-02-04 7:41 ` Dave Taht
2013-02-04 14:17 ` Maciej Soltysiak
2013-02-04 16:37 ` Dave Taht
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://lists.bufferbloat.net/postorius/lists/cerowrt-devel.lists.bufferbloat.net/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAD6NSj5ZPr1yz9FqnyusicqsdM42itc+HGqZ-1-EZpy0onf19g@mail.gmail.com \
--to=ketkulka@gmail.com \
--cc=cerowrt-devel@lists.bufferbloat.net \
--cc=dave.taht@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox