I took a look to rfc792 (ICMP) and fOr every message supposed to carry
the errored packet it says:
Internet Header + 64 bits of Data Datagram
The internet header plus the first 64 bits of the original
datagram's data. This data is used by the host to match the
message to the appropriate process. If a higher level protocol
uses port numbers, they are assumed to be in the first 64 data
bits of the original datagram's data.
I assume it's just the fisrt 8 bytes. Otherwise it would be a waste of
badwidth that at the time when it was written (1981) would had been
unacceptable. So far I've never seen more than that.
On Tue, 22 Mar 2005 16:10:33 +0100, Michael Tuexen
<Michael.Tuexen@xxxxxxxxxxxxxxxxx> wrote:
> As far as I know ICMP packets are required to contain
> at least the first 8 bytes. But they can contain more...
>
> Best regards
> Michael
>
> On Mar 22, 2005, at 15:55 Uhr, julien.leproust@xxxxxxxx wrote:
>
> > LEGO a écrit :
> >> On Tue, 22 Mar 2005 15:33:16 +0100, julien.leproust@xxxxxxxx
> >> <julien.leproust@xxxxxxxx> wrote:
> >> Just a reminder:
> >> ICMP messages carry only the first 64 bits (eight octets) of the
> >> payload of the errored ip packet. i.e. just enough for the UDP header.
> >
> > Ok, I didn't know. Too bad, that would have been fun :)
> >
> > --
> > Julien Leproust
> >
> >
> > _______________________________________________
> > Ethereal-users mailing list
> > Ethereal-users@xxxxxxxxxxxx
> > http://www.ethereal.com/mailman/listinfo/ethereal-users
> >
>
>
--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan
