Documentation
¶
Overview ¶
Package icmp decodes ICMP (RFC 792) and ICMPv6 (RFC 4443 + 4861 for Neighbor Discovery) packets.
Wrap-vs-native judgement
Native. Both ICMP and ICMPv6 wire formats are fully public IETF specs with tight fixed-layout headers (type / code / checksum / rest-of-header) and a small, well-documented per-type body catalogue. Neighbor Discovery (RFC 4861) layers a simple option TLV walker on top of NDP message bodies. Operators paste the bytes starting at the ICMP type field (after the IPv4/IPv6 header strip) from a Wireshark Follow-IP-Stream, a `tcpdump -X icmp` line, or any packet capture and get the documented type/code names plus per-type body dissection. Pure offline parser, no state, no crypto.
What this package covers
Auto-detect ICMPv4 vs ICMPv6: when the caller specifies `version` ("v4" or "v6") we honour it. Otherwise we heuristic: types ≥ 128 are ICMPv6 (echo + NDP + MLD live there); types 1-30 default to ICMPv4 (where they collide on Destination Unreachable / Time Exceeded the v4 interpretation is chosen as the more common one).
Common header (4 bytes): Type + Code + Checksum (BE). The checksum is surfaced as hex; verification requires the pseudo-header for ICMPv6 (out of scope at this layer).
ICMPv4 types decoded with names + codes: 0 Echo Reply, 3 Destination Unreachable (codes 0-15), 4 Source Quench (deprecated), 5 Redirect (codes 0-3), 8 Echo Request, 9 Router Advertisement, 10 Router Solicitation, 11 Time Exceeded (codes 0-1), 12 Parameter Problem (codes 0-2), 13 Timestamp, 14 Timestamp Reply, 15 Information Request (deprecated), 16 Information Reply (deprecated), 17 Address Mask Request, 18 Address Mask Reply, 30 Traceroute (deprecated).
ICMPv6 types decoded with names + codes (RFC 4443): 1 Destination Unreachable (codes 0-7), 2 Packet Too Big, 3 Time Exceeded (codes 0-1), 4 Parameter Problem (codes 0-3), 128 Echo Request, 129 Echo Reply, 130-132 MLD (Multicast Listener), 133 Router Solicitation, 134 Router Advertisement, 135 Neighbor Solicitation, 136 Neighbor Advertisement, 137 Redirect, 143 MLDv2.
Per-type body decoding (headline fields):
Echo Request/Reply (v4 type 8/0; v6 type 128/129): Identifier (uint16 BE) + Sequence (uint16 BE) + Data (raw bytes). Identifier+Sequence are how `ping` correlates request/reply pairs.
Destination Unreachable / Time Exceeded / Parameter Problem (v4 type 3/11/12): "unused" field surfaced as hex; the embedded original-IP+8-bytes-of-payload is surfaced as hex for the operator to feed back into `ip_packet_decode`.
Redirect (v4 type 5): Gateway IPv4 address + embedded original packet.
Neighbor Solicitation / Advertisement (v6 type 135 / 136): Reserved field + Target Address (16 bytes formatted as IPv6) + Options (TLV walker per RFC 4861 §4 — type/length(in-units-of-8)/value, with 5-entry name table: 1 Source Link-Layer Address, 2 Target Link-Layer Address, 3 Prefix Information, 4 Redirected Header, 5 MTU).
Router Advertisement (v6 type 134): Cur Hop Limit + M/O/H flags + Router Lifetime (uint16) + Reachable Time (uint32) + Retrans Timer (uint32) + Options.
What this package does NOT cover (deliberately out of scope)
IPv4 / IPv6 header parsing — feed the ICMP bytes after stripping the IP header (already handled by `ip_packet_decode`).
Checksum verification — would require the IPv6 pseudo- header for v6; v4 ICMP checksum is computable but the operator can sanity-check by comparing the captured value against the documented value.
MLD / MLDv2 group-record dissection — only the message type name is surfaced.
Per-NDP-option deep parsing beyond the name (option- specific body fields, e.g. Prefix Information's full layout, are surfaced as raw hex).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Echo ¶
type Echo struct {
Identifier uint16 `json:"identifier"`
Sequence uint16 `json:"sequence"`
DataHex string `json:"data_hex,omitempty"`
DataLen int `json:"data_length"`
}
Echo is the body of Echo Request/Reply (v4 type 8/0, v6 type 128/129).
type EmbeddedPacket ¶
type EmbeddedPacket struct {
UnusedHex string `json:"unused_hex"`
EmbeddedOriginalHex string `json:"embedded_original_ip_packet_hex"`
}
EmbeddedPacket is what v4 error messages carry — the unused 32-bit field plus the embedded original IP header + 8 bytes of payload (per RFC 792 §3).
type NDPNeighbor ¶
type NDPNeighbor struct {
Flags string `json:"flags,omitempty"` // for NA: R/S/O
TargetAddress string `json:"target_address"`
Options []NDPOption `json:"options,omitempty"`
}
NDPNeighbor is Neighbor Solicit / Advertise (v6 type 135 / 136).
type NDPOption ¶
type NDPOption struct {
Type int `json:"type"`
TypeName string `json:"type_name"`
LengthW8 int `json:"length_units_of_8"`
BodyHex string `json:"body_hex,omitempty"`
}
NDPOption is one TLV option from RFC 4861 §4.6.
type NDPRouterAdv ¶
type NDPRouterAdv struct {
CurHopLimit int `json:"cur_hop_limit"`
Flags string `json:"flags"`
RouterLifetime uint16 `json:"router_lifetime"`
ReachableTime uint32 `json:"reachable_time_ms"`
RetransTimer uint32 `json:"retrans_timer_ms"`
Options []NDPOption `json:"options,omitempty"`
}
NDPRouterAdv is Router Advertisement (v6 type 134).
type NDPRouterSol ¶
type NDPRouterSol struct {
Options []NDPOption `json:"options,omitempty"`
}
NDPRouterSol is Router Solicitation (v6 type 133).
type PacketTooBig ¶
type PacketTooBig struct {
MTU uint32 `json:"mtu"`
EmbeddedOriginalHex string `json:"embedded_original_ip_packet_hex,omitempty"`
}
PacketTooBig is ICMPv6 type 2.
type RedirectV4 ¶
type RedirectV4 struct {
GatewayIP string `json:"gateway_ip"`
EmbeddedOriginalHex string `json:"embedded_original_ip_packet_hex"`
}
RedirectV4 is ICMPv4 Redirect (type 5).
type Result ¶
type Result struct {
Version string `json:"version"` // "v4" or "v6"
Type int `json:"type"`
TypeName string `json:"type_name"`
Code int `json:"code"`
CodeName string `json:"code_name,omitempty"`
ChecksumHex string `json:"checksum_hex"`
TotalBytes int `json:"total_bytes"`
Echo *Echo `json:"echo,omitempty"`
DestUnreachable *EmbeddedPacket `json:"destination_unreachable,omitempty"`
TimeExceeded *EmbeddedPacket `json:"time_exceeded,omitempty"`
ParameterProblem *EmbeddedPacket `json:"parameter_problem,omitempty"`
Redirect *RedirectV4 `json:"redirect,omitempty"`
PacketTooBig *PacketTooBig `json:"packet_too_big,omitempty"`
NeighborSolicit *NDPNeighbor `json:"neighbor_solicitation,omitempty"`
NeighborAdvertise *NDPNeighbor `json:"neighbor_advertisement,omitempty"`
RouterSolicit *NDPRouterSol `json:"router_solicitation,omitempty"`
RouterAdvertise *NDPRouterAdv `json:"router_advertisement,omitempty"`
RawHex string `json:"raw_body_hex,omitempty"`
}
Result is the top-level decoded view.
Source Files