2

I have been reading up on ICMP recently. In RFC 792, it specifies that an ICMP Echo Response Packet is computed as follows:

The address of the source in an echo message will be the destination of the echo reply message. To form an echo reply message, the source and destination addresses are simply reversed, the type code changed to 0, and the checksum recomputed.

Does this mean that all of the IPv4 and IPv6 fields need to be copied over as well? This should include DSCP/ECN bits, IPv6 Flow Label, maybe even TTL, and other IPv6 headers that might have been included as well.

I guess I just don't know the extent of what should be copied and what should be treated as a "new" packet. If other RFC's clarify on this, please let me know too.

Improve this question

1 Answer 1

Reset to default
1

Nowhere does RFC 792 state that you should copy the IP header from the request for the reply. The phrase "to form an echo reply message ..." is merely a help to understand the basic logic.

The reply is a new packet, with a new (default) TTL. Whether DSCP bits, a flow label, etc are used depends on the replying host configuration - commonly that's not the case. And of course, you copy the ICMP header + data, just changing the type.

Improve this answer
2
  • Are we sure that is really a help though and not a requirement of the RFC? Both Linux and lwIP seems to copy the the whole header, switching the destination address and source address, resetting the TTL, and recomputing the checksum. github.com/torvalds/linux/blob/master/net/ipv4/icmp.c#L400 from request to reply. github.com/lwip-tcpip/lwip/blob/… Commented May 29, 2025 at 15:10
  • RfCs are usually rather explicit - hard to tell for this really ancient one though. My money is on if you'd have to copy the IP header even this old RfC or one of its updates would clearly say so. Also, copying all optional headers indiscriminately could create security issues for reflections attacks, so it's not the wise thing to do. Commented May 29, 2025 at 16:51

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.