首页 新闻 会员 周边 捐助

ICMP 报错 Type = 12 code = 0

0
悬赏园豆:50 [已解决问题] 解决于 2018-03-12 10:27

  Wireshark抓包分析发现有个对端发送过来的数据拆分成两个后发送过来,服务器直接会送ICMP了 查看ICMP发现 type = 12 code = 0,百度了一波说是 坏的IP首部,但是实在看不出来是啥问题,有人遇到过么,真诚请教。

  问题如图:

GYY_顽石的主页 GYY_顽石 | 初学一级 | 园豆:143
提问于:2018-03-09 11:00
< >
分享
最佳答案
0

服务器收到ICMP包,但读取IP头时发现IP包不对

推荐阅读:Understanding Guide to ICMP Protocol with Wireshark

收获园豆:50
dudu | 高人七级 |园豆:29570 | 2018-03-09 11:30

感谢大佬的帮助,不过还是没找到具体问题,还在努力探索中

GYY_顽石 | 园豆:143 (初学一级) | 2018-03-09 12:22

@GYY_顽石: 建议看一下tcp stream

dudu | 园豆:29570 (高人七级) | 2018-03-09 12:45

@dudu:    因为我做的是SIP通讯,看起来像是这个问题,不过这个ICMP报的错不一致啊,我在看看吧

GYY_顽石 | 园豆:143 (初学一级) | 2018-03-09 13:07

@dudu: 附地址:https://tools.ietf.org/html/rfc3261#section-18.1.1

GYY_顽石 | 园豆:143 (初学一级) | 2018-03-09 13:14

@GYY_顽石: 建议看一下8.1.3.1

8.1.3.1 Transaction Layer Errors
In some cases, the response returned by the transaction layer will
not be a SIP message, but rather a transaction layer error. When a
timeout error is received from the transaction layer, it MUST be
treated as if a 408 (Request Timeout) status code has been received.
If a fatal transport error is reported by the transport layer
(generally, due to fatal ICMP errors in UDP or connection failures in
TCP), the condition MUST be treated as a 503 (Service Unavailable)
status code.

dudu | 园豆:29570 (高人七级) | 2018-03-09 13:19

@dudu:  好像是对端的实现有问题,看RFC解释是 sip 的 数据大小最大是限制在 1300 以内的 (MTU - 200) 。哎,看他们怎么解释吧。

The Session Initiation Protocol (SIP) mandates a maximum size for any request transmitted over UDP. This maximum is set to the lesser of 1300 bytes or the path maximum transmission unit (MTU) size minus 200 bytes. If the size of the request exceeds this maximum, SIP requires implementations to switch the downstream transport to be a congestion  controlled transport. However, when sending a response, a SIP implementation cannot choose the transport; it must use the transport specified by the Via. This document discusses the problems large responses can cause on UDP, and proposes an update to SIP to help diagnose and avoid those problems.

GYY_顽石 | 园豆:143 (初学一级) | 2018-03-09 14:31
清除回答草稿
   您需要登录以后才能回答,未注册用户请先注册