ICMP Raw Payload Expressions

Sunny73Cr <[email protected]>
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <Aris5k4E14tRGyaRBMoLpJVwxj8ZQ7YAWng8XdmcCP-Ft4huCCAy7vfECg7hNuT96V_-83ag43NSThe0_lrUosHDmxumF6BELVRe_PRHeCU=@protonmail.com> 
Hi,

Packet structure of ICMP-DU (Destination Unreachable) (in my case) is Eth,IP4,ICMP,ICMP-DU

It is my understanding that Eth is ll, IP4 is nh, ICMP is th, and ICMP-DU is ih.

If I am to match the ICMP header, is `th` the correct offset?

If I am to match the ICMP-DU content, is `ih` the correct offset?

Thanks,
sunny
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.