Re: ipf icmp types?

["Crist J . Clark" <cjclark@reflexnet.net>]

On Thu, Nov 30, 2000 at 09:44:13AM +0100, Jan Muenther wrote:
> > RFC 792 suggests ICMP 8/0 is an echo reply. 
> 
> Erm... I'm not quite common with how ipf logs this stuff, since I
> mainly monitor it with my IDS, but type 8 really is an echo
> request to me... what does /0 mean in this context...? As far as
> I know, an ICMP packet can have only one type...!?

Both the ICMP code and type are one-byte (8-bit) fields in the ICMP
packet. Even though there are only certain _valid_ code and type
pairs, there is no reason one cannot craft packets with arbirary
values in these fields.
-- 
Crist J. Clark                           cjclark@alum.mit.edu