tcpdump mailing list archives
Re: v4/v6 packet length printing inconsistency
From: Gert Doering <gert () greenie muc de>
Date: Wed, 2 Jul 2025 23:19:59 +0200
Hi, On Wed, Jul 02, 2025 at 03:28:59PM -0400, Michael Richardson wrote:
Gert Doering <gert () greenie muc de> wrote:
> I've been writing a document explaining inside/outside fragmentation in
> an OpenVPN context, explaining my points with "tcpdump", like this:
> $ tcpdump -vv -i any host ... or host ...
Note also that you are comparing the ICMPv6 printer vs the UDP printer.
True, but the UDP printer is not the one printing the "real packet length"
and introducing the newline - that comes from print-ip.c.
-v on an IPv4 ICMP looks the same...
gert@blueNUC2:/home/gert/src/tcpdump.git$ SU ./tcpdump -v -n -s0 -i tun1
existing output for IPv4 ICMP ("ping -s 64"):
23:18:12.121037 IP (tos 0x0, ttl 64, id 36165, offset 0, flags [DF], proto ICMP (1), length 92)
10.231.203.11 > 10.231.203.1: ICMP echo request, id 28546, seq 1, length 72
23:18:12.135331 IP (tos 0x0, ttl 64, id 26157, offset 0, flags [none], proto ICMP (1), length 92)
10.231.203.1 > 10.231.203.11: ICMP echo reply, id 28546, seq 1, length 72
new output format for IPv6 ICMP ("ping6 -s 64"):
23:19:12.042337 IP6 (flowlabel 0x381c8, hlim 64, next-header ICMPv6 (58), length 112)
fd48:82aa:99e6::1009 > fd48:82aa:99e6::: [icmp6 sum ok] ICMP6, echo request, id 28661, seq 1, length 72
23:19:12.056159 IP6 (flowlabel 0x6ff2e, hlim 64, next-header ICMPv6 (58), length 112)
fd48:82aa:99e6::1 > fd48:82aa:99e6::1009: [icmp6 sum ok] ICMP6, echo reply, id 28661, seq 1, length 72
If anything, I'd want to fix the UDP printer to not use multiple lines, because it breaks people who are trying to grep.
Use "tcpdump -g" then :-)
gert
--
"If was one thing all people took for granted, was conviction that if you
feed honest figures into a computer, honest figures come out. Never doubted
it myself till I met a computer with a sense of humor."
Robert A. Heinlein, The Moon is a Harsh Mistress
Gert Doering - Munich, Germany gert () greenie muc de
_______________________________________________
tcpdump-workers mailing list -- tcpdump-workers () lists tcpdump org
To unsubscribe send an email to tcpdump-workers-leave () lists tcpdump org
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s
Current thread:
- Re: v4/v6 packet length printing inconsistency Gert Doering (Jul 01)
- <Possible follow-ups>
- Re: v4/v6 packet length printing inconsistency Michael Richardson (Jul 02)
- Re: v4/v6 packet length printing inconsistency Gert Doering (Jul 02)
