icmp ttl and total_length are displayed with commas

asked 2019-02-13 18:27:37 +0000

geo555
3 ●1 ●2

updated 2019-02-13 19:25:33 +0000

Guy Harris
19890 ●3 ●660 ●207

Hello, I did a capture on my local lan and I see something very weird.

the ttl and total length field on icmp packets that are unreachable adds decimals.

the cap is very big, 300,000 files, but the a screen capture is here: https://i.imgur.com/lzfr5tV.png

it drives me crazy, any ideas?

(using wireshark 2.6.5)

george

answered 2019-02-13 18:59:49 +0000

Packet_vlad

1055 ●5 ●75 ●32 http://packettrain.net

updated 2019-02-13 19:03:46 +0000

All the packets you've shown are ICMPs which have two IP headers - own ICMP's IP header and original packet IP header. So TTL values correspond to both IP headers. Try to expand all packet details under ICMP subtree and you'll spot the source of the second TTL value.

edit flag offensive delete link

Comments

ok thanks, i got that, but can I have as column only one the two?

geo555 ( 2019-02-13 19:14:18 +0000 )edit

yes, you can. Right-click on a column header, select Edit Column and change Occurrence value where 0 means "display all such field values", 1 means "display only first field value" etc.

Packet_vlad ( 2019-02-13 19:23:43 +0000 )edit

ok, thanks, it worked!

geo555 ( 2019-02-13 19:35:40 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

icmp ttl and total_length are displayed with commas

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

icmp ttl and total_length are displayed with commas edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

icmp ttl and total_length are displayed with commas