From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-vb0-f53.google.com (mail-vb0-f53.google.com [209.85.212.53]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority" (verified OK)) by huchra.bufferbloat.net (Postfix) with ESMTPS id E97AC21F0B3 for ; Sun, 3 Feb 2013 23:34:58 -0800 (PST) Received: by mail-vb0-f53.google.com with SMTP id fj18so3708655vbb.12 for ; Sun, 03 Feb 2013 23:34:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:in-reply-to:references:date:message-id :subject:from:to:cc:content-type:content-transfer-encoding; bh=r7Rop5eiFWE14EVmh51gDVPPVnVKgbqZr2ueN5Vp/1s=; b=tEOaZP5A2q4GvHzhwsHAkuy4b/a4/Xq51Xf4GT+7zxw2pzTO7R4PghRwkxYL7KMsRr vz8dhY53kp+HgZRUjQGLpLVTVFNgNCgoCvGSdAiSjjJjD0jTCefdlAd6Zs990Dr9RQXD XcYCXoLHWOpptYeIuK4zbtWi9MgUugbQy1ndJgjUUfsFoqDDdNbpAE2rW2k4iPWJscP0 Rp/RV85mNW46nH3VTHfdwd512bIUcuXUJwZwV/xvkmFBFHS/ZruPxD20oGhAlKeuNfER YqlFliVA0+bchrX44rGn2Do26cueyedpWT5ErNAKNATcUbuXVhFz0N15qRFCMai3WzAC 62jA== MIME-Version: 1.0 X-Received: by 10.220.119.200 with SMTP id a8mr20759716vcr.38.1359963297861; Sun, 03 Feb 2013 23:34:57 -0800 (PST) Received: by 10.58.107.166 with HTTP; Sun, 3 Feb 2013 23:34:57 -0800 (PST) In-Reply-To: References: Date: Mon, 4 Feb 2013 13:04:57 +0530 Message-ID: From: Ketan Kulkarni To: Dave Taht Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: cerowrt-devel@lists.bufferbloat.net Subject: Re: [Cerowrt-devel] ping icmp ttl exceeded X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.13 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Feb 2013 07:34:59 -0000 Sorry to send it again, as the list rejected the attachment (attachment removed in this one) Hi Dave, The TTL is decremented by 1 on every router. If it reaches 0, the pkt is dropped and ICMP ttl exceeded is sent to the sender with icmp body =3D first few bytes of the packet which caused this error. Looks like, for every new Echo Req, ip ttl is set to 1. The next router decrements it and send ICMP ttl exceeded back. So 172.20.26.17 send Echo Req to 172.20.0.1 with ttl=3D1. 172.20.26.1 (probably your next router) decrements and sends ICMP TTL exceeded to 172.20.26.17 (probably your client) For the next request, ttl=3D2 and this time 172.20.26.17 (next to next router) send ttl exceeded. This is happening till ttl=3D6 at which the Echo Req is successful. Probably this is the behaviour of ping cmd used with -R (record route) option enabled. Attached jpg for reference. -Ketan On Mon, Feb 4, 2013 at 1:03 PM, Ketan Kulkarni wrote: > Hi Dave, > > The TTL is decremented by 1 on every router. If it reaches 0, the pkt > is dropped and ICMP ttl exceeded is sent to the sender with icmp body > =3D first few bytes of the packet which caused this error. > Looks like, for every new Echo Req, ip ttl is set to 1. The next > router decrements it and send ICMP ttl exceeded back. > > So 172.20.26.17 send Echo Req to 172.20.0.1 with ttl=3D1. > 172.20.26.1 (probably your next router) decrements and sends ICMP TTL > exceeded to 172.20.26.17 (probably your client) > > For the next request, ttl=3D2 and this time 172.20.26.17 (next to next > router) send ttl exceeded. > This is happening till ttl=3D6 at which the Echo Req is successful. > > Probably this is the behaviour of ping cmd used with -R (record route) > option enabled. > > Attached jpg for reference. > > -Ketan > > On Mon, Feb 4, 2013 at 12:40 PM, Dave Taht wrote: >> I have been largely looking at packet captures for tcp streams. today I >> noticed that I was oddly getting icmp ttl exceeded messages back on the >> network from various devices on the path when I wasn't even pinging... >> >> I have to admit parsing icmp is not in my skillset. Is there useful >> information in the icmp messages in this capture? >> >> http://snapon.lab.bufferbloat.net/~d/ttl_exceeded.cap >> >> -- >> Dave T=E4ht >> >> Fixing bufferbloat with cerowrt: >> http://www.teklibre.com/cerowrt/subscribe.html >> _______________________________________________ >> Cerowrt-devel mailing list >> Cerowrt-devel@lists.bufferbloat.net >> https://lists.bufferbloat.net/listinfo/cerowrt-devel >>