1,I C M P报文的格式。所有报文的前4个字节都是一样的,但是剩下的其他字节则互不相同。下面我们将逐个介绍各种报文格式.
//ICMP头部,总长度4字节
typedef struct _icmp_hdr
{
unsigned char icmp_type; //类型
unsigned char code; //代码
unsigned short chk_sum; //16位检验和
}icmp_hdr;
不同类型的报文(8位类型+8位代码)
(1)ping的request报文和reply报文分析:
//icmp报文(能到达目的地,响应-请求包)
struct icmp8
{
u_char icmp_type; //type of message(报文类型)
u_char icmp_code; //type sub code(报文类型子码)
u_short icmp_cksum;
u_short icmp_id;
u_short icmp_seq;
char icmp_data[1];
};
//icmp报文(能返回目的地,响应-应答包)
struct icmp0
{
u_char icmp_type; //type of message(报文类型)
u_char icmp_code; //type sub code(报文类型子码)
u_short icmp_cksum;
u_short icmp_id;
u_short icmp_seq;
char icmp_data[1];
};
(2)不可达报文
//icmp报文(不能到达目的地)
struct icmp3
{
u_char icmp_type; //type of message(报文类型)
u_char icmp_code; //type sub code(报文类型子码),例如:0网络原因不能到达,1主机原因不能到达...
u_short icmp_cksum;
u_short icmp_pmvoid;
u_short icmp_nextmtu;
char icmp_data[1];
};
(3) icmp重发(重定向)
//icmp报文(重发结构体)
struct icmp5
{
u_char icmp_type; //type of message(报文类型)
u_char icmp_code; //type sub code(报文类型子码)
u_short icmp_cksum;
struct in_addr icmp_gwaddr;
char icmp_data[1];
};
(4)icmp超时
struct icmp11
{
u_char icmp_type; //type of message(报文类型)
u_char icmp_code; //type sub code(报文类型子码)
u_short icmp_cksum;
u_int icmp_void;
char icmp_data[1];
};