Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

answered 2020-02-14 04:44:05 +0000

Chuckc gravatar image

The bellhop took them? (https://en.wikipedia.org/wiki/Missing_dollar_riddle)

https://tools.ietf.org/html/rfc792

Echo or Echo Reply Message

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |     Code      |          Checksum             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |           Identifier          |        Sequence Number        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Data ...
   +-+-+-+-+-

The ICMP part of the packet is 8 bytes of header plus 9000 bytes of data = 9008 bytes ICMP.
Those 9000 bytes of data are an 8 bytes timestamp plus 8992 bytes of padding.
https://linux.die.net/man/8/ping

ECHO_REQUEST datagrams (''pings'') have an IP and ICMP header, followed by a struct timeval and then an arbitrary number of ''pad'' bytes used to fill out the packet.