ICMP - Yet another destination unreachable - Rookie
Hi there, I am no Wireshark neither packet capture expert, nevertheless I am attempting to understand why a SIP/TLS app is not behaving as expected, so I have attached wireshark to a mirrored port on our switch, which mirrors all traffic on the PBX network.
What comes to my eyes is that we have some ICMP errors:
No. Time Source Destination Protocol Length Info DSCP 1056 11:27:32.748536
172.16.4.10 8.8.8.8 ICMP 174 Destination unreachable (Port unreachable) Class Selector 6,Default
Frame 1056: 174 bytes on wire (1392 bits), 174 bytes captured (1392 bits) on interface \Device\NPF_{--------HIDDEN----------}, id 0
Interface id: 0 (\Device\NPF_{--------HIDDEN----------})
Encapsulation type: Ethernet (1)
Arrival Time: Apr 16, 2021 11:27:32.748536000 W. Europe Daylight Time
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1618565252.748536000 seconds
[Time delta from previous captured frame: 0.000332000 seconds]
[Time delta from previous displayed frame: 0.000332000 seconds]
[Time since reference or first frame: 56.350984000 seconds]
Frame Number: 1056
Frame Length: 174 bytes (1392 bits)
Capture Length: 174 bytes (1392 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ip:icmp:ip:udp:dns]
[Coloring Rule Name: ICMP errors]
[Coloring Rule String: icmp.type eq 3 || icmp.type eq 4 || icmp.type eq 5 || icmp.type eq 11 || icmpv6.type eq 1 || icmpv6.type eq 2 || icmpv6.type eq 3 || icmpv6.type eq 4] Ethernet II, Src: Panasoni_yy:yy:yy (xx:xx:xx:xx:xx:xx), Dst: PeplinkI_xx:xx:xx (yy:yy:yy:yy:yy:yy)
Destination: PeplinkI_xx:xx:xx (yy:yy:yy:yy:yy:yy)
Address: PeplinkI_xx:xx:xx (yy:yy:yy:yy:yy:yy)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: Panasoni_yy:yy:yy (xx:xx:xx:xx:xx:xx)
Address: Panasoni_yy:yy:yy (xx:xx:xx:xx:xx:xx)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv4 (0x0800) Internet Protocol Version 4, Src: 172.16.4.10, Dst: 8.8.8.8
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0xc0 (DSCP: CS6, ECN: Not-ECT)
1100 00.. = Differentiated Services Codepoint: Class Selector 6 (48)
.... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
Total Length: 160
Identification: 0xfaa4 (64164)
Flags: 0x00
0... .... = Reserved bit: Not set
.0.. .... = Don't fragment: Not set
..0. .... = More fragments: Not set
Fragment Offset: 0
Time to Live: 64
Protocol: ICMP (1)
Header Checksum: 0xbece [validation disabled]
[Header checksum status: Unverified]
Source Address: 172.16.4.10
Destination Address: 8.8.8.8 Internet Control Message Protocol
Type: 3 (Destination unreachable)
Code: 3 (Port unreachable)
Checksum: 0xbda8 [correct]
[Checksum Status: Good]
Unused: 00000000
Internet Protocol Version 4, Src: 8.8.8.8, Dst: 172.16.4.10
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
0000 00.. = Differentiated Services Codepoint: Default (0)
.... ..00 ...
This packet has a lot of good information. This is only a small bit of what you can extract from the decode. Per Wireshark, this is a duplicate. You will need the user symptoms, topology and traceroute to isolate the issue(s).
Packet decode information The original packet info: Src: 8.8.8.8, Dst: 172.16.4.10, User Datagram Protocol, Src Port: 53, Dst Port: 63882.
DNS response to mobile-sip-1277875736 ...(more)