Ask Your Question
0

icmp ttl and total_length are displayed with commas

asked 2019-02-13 18:27:37 +0000

geo555 gravatar image

updated 2019-02-13 19:25:33 +0000

Guy Harris gravatar image

Hello, I did a capture on my local lan and I see something very weird.

the ttl and total length field on icmp packets that are unreachable adds decimals.

the cap is very big, 300,000 files, but the a screen capture is here: https://i.imgur.com/lzfr5tV.png

it drives me crazy, any ideas?

(using wireshark 2.6.5)

george

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-02-13 18:59:49 +0000

updated 2019-02-13 19:03:46 +0000

All the packets you've shown are ICMPs which have two IP headers - own ICMP's IP header and original packet IP header. So TTL values correspond to both IP headers. Try to expand all packet details under ICMP subtree and you'll spot the source of the second TTL value.

edit flag offensive delete link more

Comments

ok thanks, i got that, but can I have as column only one the two?

geo555 gravatar imagegeo555 ( 2019-02-13 19:14:18 +0000 )edit

yes, you can. Right-click on a column header, select Edit Column and change Occurrence value where 0 means "display all such field values", 1 means "display only first field value" etc.

Packet_vlad gravatar imagePacket_vlad ( 2019-02-13 19:23:43 +0000 )edit

ok, thanks, it worked!

geo555 gravatar imagegeo555 ( 2019-02-13 19:35:40 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-02-13 18:27:37 +0000

Seen: 29 times

Last updated: Feb 13