cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3980
Views
0
Helpful
5
Replies

ICMP Echo Reply

srimural
Level 1
Level 1

Hi,

I need to know whether if i set a DSCP value on a ICMP echo request, will that same DSCP value be set on the reply packet. Just need to confirm , if i do a TOS based extended ping will reply come in the same class of service.

Regards,

Srinath M

5 Replies 5

Srinath,

I just test by using an extend ping command with TOS 6. Then do "debug ip packet detail dump".

###############Echo-request###################

*Apr 16 16:17:34.891: IP: tableid=0, s=2.2.2.2 (local), d=2.2.2.1 (FastEthernet0/0), routed via FIB

*Apr 16 16:17:34.895: IP: s=2.2.2.2 (local), d=2.2.2.1 (FastEthernet0/0), len 100, sending

*Apr 16 16:17:34.899: ICMP type=8, code=0

091FAED0: 45060064 001D0000 E..d....

091FAEE0: FF01B36F 02020202 02020201 0800EA4F ..3o..........jO

091FAEF0: 00050004 00000000 00799378 ABCDABCD .........y.x+M+M

091FAF00: ABCDABCD ABCDABCD ABCDABCD ABCDABCD +M+M+M+M+M+M+M+M

091FAF10: ABCDABCD ABCDABCD ABCDABCD ABCDABCD +M+M+M+M+M+M+M+M

091FAF20: ABCDABCD ABCDABCD ABCDABCD ABCDABCD +M+M+M+M+M+M+M+M

091FAF30: ABCDABCD ABCDABCD ABCDABCD +M+M+M+M+M+M

###############Echo-reply###################

*Apr 16 16:17:34.939: IP: tableid=0, s=2.2.2.1 (FastEthernet0/0), d=2.2.2.2 (FastEthernet0/0), routed via RIB

*Apr 16 16:17:34.943: IP: s=2.2.2.1 (FastEthernet0/0), d=2.2.2.2 (FastEthernet0/0), len 100, rcvd 3

*Apr 16 16:17:34.947: ICMP type=0, code=0

092C8B00: CA00 09F80008 J..x..

092C8B10: CA0109F8 00080800 45060064 001D0000 J..x....E..d....

092C8B20: FE01B46F 02020201 02020202 0000F24F ~.4o..........rO

092C8B30: 00050004 00000000 00799378 ABCDABCD .........y.x+M+M

092C8B40: ABCDABCD ABCDABCD ABCDABCD ABCDABCD +M+M+M+M+M+M+M+M

092C8B50: ABCDABCD ABCDABCD ABCDABCD ABCDABCD +M+M+M+M+M+M+M+M

092C8B60: ABCDABCD ABCDABCD ABCDABCD ABCDABCD +M+M+M+M+M+M+M+M

092C8B70: ABCDABCD ABCDABCD ABCDABCD +M+M+M+M+M+M

##################################

I'm assuming that number 45 is as follows :

#(4 bits) VERS - is the IP version number (currently binary 0100 (4), but can now also be version 6). All nodes must use the same version.

#(4 bits) HLEN - header length in 32-bit words, so if the number is 6, then 6 x 32 bit words are in the header i.e. 24 bytes. The maximum size is 15 x 32-bit words which is 60 bytes. The minimum size is 20 bytes or 5 x 32-bit words.

The next 8 bits is TOS. That's 06. Both packets are the same value.

I'm not 100% sure but (grin)

Toshi

Hi Toshi,

I will also do a sniff on the packet and update. coz normally in operational environment for a class based delay check it will be done using an extended ping. :)

Nice to hear from you and so quick as well.

Regards,

Srinath M

Joseph W. Doherty
Hall of Fame
Hall of Fame

My experience has been Cisco routers and swiches seem to echo back the same ToS.

Unsure whether there's any requirement to do so. Also keep in mind, ToS could be reset along the path in either direction.

Hi Joseph,

the requirement will be in checking the end to end delay in a particular class of service. if the reply packet does not have the TOS copied, the reply will come in the standard class which will not give you a accurate reading of the RTD in the class.

This what i feel it is.. might be wrong as well.. please correct me.. if i am..

Regards,

Srinath M

Yes, of course, if the ToS changes on the return packet, performance measurements can be skewed. Again though, I believe (most/all?) Cisco routers/switches echo the received ToS.

Beside wire packet analyzers, I've found using NBAR DSCP matching on input is often an easy way, if there isn't much other active traffic using the test DSCP marking, to verify something like an extended ping with ToS settings. (If you try this, don't forget to allow for the 4x difference between ToS and DSCP.)

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco