Today when I test running a
tracert command (windows + Wireshark) I see a outbound ICMP_ECHO_REQUEST packet that has sourceIP as "192.168.1.55" - my local IPAddress.
It is followed by a ICMP_TTL_EXCEEDED packet sent from an internet wild host as reply to me that my EchoRequest packet died halfway. The reply-packet "quotes" first 28 byte of my "original packet" in the payload section where I can see the sourceIP staying "192.168.1.55" - my local ipAddress.
A question immediately pops out of my head: "The NAT did not rewrite the "local" sourceIP in IP-Header or did him rewrite it in payload "?
AFAIK in case of TCP or UDP packets, the NAT will replace the local "ip:port" with external "IP:PORT" in the IP-Header of the packet. So I am wondering:
1 - Whether NATs are replacing them in the payload section of packets? (Or just do that with ICMP packet of type TTL_Exceeded only?)
2 - If 1 is not true, is this a kind of security threat?