community-id-spec
community-id-spec copied to clipboard
additional request-reply pair ICMP/ICMPv6: Extended Echo
At https://tools.ietf.org/html/rfc8335 an additional request-reply pair is documented. ICMP field Type: Extended Echo Request. The value for ICMPv4 is 42. The value for ICMPv6 is 160 ICMP field Type: Extended Echo Reply. The value for ICMPv4 is 43. The value for ICMPv6 is 161
Since that wasn’t in the version 1 table of the reference Corelight python, hashes using that code would set one or the other "port-like value" to the code octet instead of to the type octet of the corresponding request-response peer. This issue was also reported as: https://github.com/corelight/pycommunityid/issues/2#event-3795843269
This specific case also highlights that: which pairs are in the table of the corresponding request-response ICMP and ICMPv6 pairs, is a specification point, and should not be subject to variation, or derived from a reference implementation outside of the specification.