icmp數(shù)據(jù)包格式分析

1、ICMP數(shù)據(jù)包格式分析ICMP報(bào)文格式ICMP網(wǎng)絡(luò)控制報(bào)文協(xié)議包含有一下幾個(gè)字段，類型、代碼、校驗(yàn)和、identifier、序列號(hào)、圖1請(qǐng)求應(yīng)答報(bào)文對(duì)請(qǐng)求與應(yīng)答報(bào)文對(duì)可分為回應(yīng)請(qǐng)求與應(yīng)答報(bào)文、路由器請(qǐng)求與通告報(bào)文、時(shí)間戳請(qǐng)求與應(yīng)答報(bào)文和地址掩碼請(qǐng)求與應(yīng)答報(bào)文。如圖2所示為一組回應(yīng)請(qǐng)求與應(yīng)答報(bào)文：請(qǐng)求報(bào)文類型為8,表示回應(yīng)請(qǐng)求報(bào)文,傳遞的ping命令通常用于測(cè)試信宿的可到達(dá)性(如圖3)。Inte門亡1GontredMessageProtocolType:B(Echo(pimg)request)code:0Checksum:0 xe90acorrectidentifier(be):0(0 x000

2、0)identifier(le):0(0 x0000)Sequencenumber(EE):1(0 x0001)sequencenumber(LE):256(0 x0100)芻電：門：21田Data(72bytes)圖3應(yīng)答報(bào)文類型為0，表示回應(yīng)應(yīng)答報(bào)文。比較這組報(bào)文對(duì)，其標(biāo)識(shí)符和序列號(hào)是一樣的，且數(shù)據(jù)部分也是一樣的(如圖4)。InternEtGontredMessageProtocolType:0(Echo(pimg)reply)code:0Checksum:OxflOacorrectidentifier(be):0(0 x0000)identifier(le):0(0 x0000)Sequ

3、encenumber(EE):1(0 x0001)sequencenumber(LE):256(0 x0100)REEDOn芻電To:11ResponseTime:31.000ms田Data(72bytes)圖4差錯(cuò)報(bào)告1下圖為一個(gè)UDP數(shù)據(jù)報(bào)錯(cuò)誤引發(fā)的信宿不可達(dá)報(bào)告：Filter:|ip.id=26391TExpression.ClearApply5our匚已DestinationProto匚ol亠Info222.95.20.45220.181.61.201UDPSourceoort:4574Dee3InternetControlMessageProtocolType:3(Destinati

4、onunreachable)Code:3(Portunrea匚hable)Checksum:0 xde55correctInternetProtocol,Src:222.95.20.45(222.95.20.45),Dst:220.181.61.201Vers1on:4Header1ength:20bytesDifferentiatedServicesField:0 x00(DSCP0 x00:Default;ECN:0 x00)TotalLength:780Identif1cation:0 x6717(26391)卜Flags:0 x00Fragmentoffset:0Timetolive:

5、122報(bào)告類型為3,代碼為3，說(shuō)明產(chǎn)生信宿不可達(dá)報(bào)文的原因可能是端口不可達(dá)。在ICMP報(bào)文的數(shù)據(jù)部分封裝了出錯(cuò)數(shù)據(jù)報(bào)的部分信息。本例中封裝了出錯(cuò)的IP數(shù)據(jù)報(bào)首部和核日P數(shù)據(jù)報(bào)封裝的UDp首部和一部分?jǐn)?shù)據(jù)段(這里與書上有些差異，書上說(shuō)是數(shù)據(jù)部分的前6#位，本例中為520個(gè)字節(jié)的數(shù)據(jù)，看了其他同類型報(bào)文封裝的數(shù)據(jù)大小不一9麗產(chǎn)生信宿不可達(dá)報(bào)文的原因還有可能是網(wǎng)絡(luò)不可達(dá)、主機(jī)不可達(dá)和協(xié)議不可達(dá)等。其代碼分別為0、1、2。如下圖是主機(jī)不可達(dá)：78.226.196.10222.95.20.45ICMPDestinationunreachabIe(HostunreachabIe2.下圖為一個(gè)ICMP請(qǐng)求超

6、時(shí)引發(fā)的數(shù)據(jù)報(bào)超時(shí)報(bào)告:Filter:ip.id=46817Expression.ClearAjjplyTimeSource亠DestinationrotocolInfo125一”拆菲JR一q5一兀一45刀尺一引一qi一iF（h門門i門門）廣1戸門丨戸臨1iInternetControlMessageProtocolType:11(Time-to-1iveexceeded)Code:0(Timeto11veexceeded1ntrans11)Checksum:OxQfaBcorrect-InternetProtocol,Src:222.95.20.45(222.95.20.45),Dst:218.31.91.1(21：Version:4Header1ength:20bytesDifferentiatedServicesField:0 x00(DSCP0 x00:Default;ECN:0 x00)TotalLength:60Identification:0 xb6el(46817)Flags:0 x00報(bào)告類型為代碼為：0,說(shuō)明是路由器TTL超時(shí)。該報(bào)文