Bjorn Mork wrote:
No, an ICMP echo reply does not include the entire request packets
RFC792: The data received in the echo message must be returned in the echo reply message.
RFC792: Echo or Echo Reply Message 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type | Code | Checksum | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Identifier | Sequence Number | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Data ... +-+-+-+-+- The data excludes IP and ICMP header and is not "the entire request packets". Once an echo request packet is reassembled, which may cause buffer overflow with poor implementations, you only have to rewrite type, checksum and IP header to construct echo reply without copying data, which is what BSD kernel is doing. Masataka Ohta