0
votes

I'm creating a Tracert program and am wondering if the value "buffer" used in the Ping payload really matters. Can it be anything, or do routers respond differently based on the contents of the buffer?

What about the other parts of an ICMP ping message? Don't Fragment, etc...

http://msdn.microsoft.com/en-us/library/ms144962.aspx

I found one sample that sets the buffer like this:

    byte[] Buffer
    {
        get
        {
            if (_buffer == null)
            {
                _buffer = new byte[32];
                for (int i = 0; i < Buffer.Length; i++)
                {
                    _buffer[i] = 0x65;
                }
            }
            return _buffer;
        }
    }

3 Answers 3

1
vote

No, the data section of an ICMP echo is not meaningful.

It serves as a means to make the request and reply packets larger (potentially past the point of fragmentation, the path's MTU) to test network conditions, but is not handled in any way by ICMP implementations (aside from being copied into the echo reply by a responding device).

3
  • Will any WAN optimization features have an effect here, or does it not matter for these purposes? Sep 1, 2011 at 18:06
  • Some OSes (particularly Windows) include timestamps in echo requests and replies. Sep 1, 2011 at 18:14
  • Interesting question - I suppose if a compressing optimizer were set to act on ICMP packets, with a remote peer decompressing (which wouldn't make a ton of sense, really - they aren't a ton of traffic and you can't really improve the metric that matters for them, response time), then a packet with pure random data in that section would compress less well than one that just sticks predictable data in there, such as the 0x65 in every byte above. It'd completely depend on the optimizer, though. Sep 1, 2011 at 18:16
1
vote

The data section of an echo request is optional. You only need to include it if you wish to

  • make the message larger to test for fragmentation-realated problems
  • test whether specific bit-patterns cause problems for your network devices (e.g. they might interpret long strings of ones or zeroes as a command to enter test mode)

A good reference on this topic is Eric Hall's Internet Core Protocols.

2
  • Isn't the data section (of some length) required with the no-fragment set? Sep 1, 2011 at 18:26
  • On linux, I just ran ping -M do -s 0 localhost (which sets don't fragment and does not have a data section) without any trouble.
    – sciurus
    Sep 1, 2011 at 21:04
0
votes

It depends. For timestamps, redirects, and unreachable messages the payload contains valuable information. Even echo request and reply payloads can contain information like timestamps.

You say that you're writing a traceroute program, but then you use the phrase "Ping payload" which suggests that you're trying to process ICMP echo requests and replies. While it's certainly possible to use ICMP messages for tracing routes (it's your only option with tracert on Windows) you won't be able to trace the complete path in many cases since overzealous admins often block echoes.

You might want to consider using other protocols for your probes, specifically TCP. When tracing the route to a web server for example, traceroute (which uses UDP by defualt) or tracert (ICMP) isn't nearly as useful as nmap -Pn --traceroute -p 80 or tcptraceroute.

2
  • I'm a little confused by this answer... can you be more detailed on the protocols used? Comparing UDP against ICMP isn't clear to me. Sep 1, 2011 at 18:15
  • 1
    You're trying to write a traceroute program, correct? Traceroute works by sending probes with low IP (not ICMP) time-to-live values and looking for matching ICMP time-to-live exceeded responses. Although the responses will always be ICMP, the probes themselves can be any protocol that runs on top of IP -- ICMP, UDP, TCP, SCTP, AH, ESP, etc. Sep 1, 2011 at 18:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .