community-id-spec icon indicating copy to clipboard operation
community-id-spec copied to clipboard

additional request-reply pair ICMP/ICMPv6: Extended Echo

Open duffy-ocraven opened this issue 3 years ago • 0 comments

At https://tools.ietf.org/html/rfc8335 an additional request-reply pair is documented. ICMP field Type: Extended Echo Request. The value for ICMPv4 is 42. The value for ICMPv6 is 160 ICMP field Type: Extended Echo Reply. The value for ICMPv4 is 43. The value for ICMPv6 is 161

Since that wasn’t in the version 1 table of the reference Corelight python, hashes using that code would set one or the other "port-like value" to the code octet instead of to the type octet of the corresponding request-response peer. This issue was also reported as: https://github.com/corelight/pycommunityid/issues/2#event-3795843269

This specific case also highlights that: which pairs are in the table of the corresponding request-response ICMP and ICMPv6 pairs, is a specification point, and should not be subject to variation, or derived from a reference implementation outside of the specification.

duffy-ocraven avatar Sep 23 '20 18:09 duffy-ocraven