received ICMP packet - wrong src & dst port numbers

Jul 31, 2013 at 9:15 AM
Hi, when I receive ICMP packet (UDP) I can't get "real" source and destination port numbers. I'm trying to get this values from received packet -> packet.Ethernet.IpV4.Udp.SourcePort (respectively DestinationPort). But values I get according to wireshark are: src port -> ICMP type + code (4 hexadecimal values), dst port -> ICMP checksum (4 hex as well).

Received packet has valid values and I can get them manually from payload but this approach seems not very safe because position in byte stream can change.

I really appreciate any help you can provide.
Coordinator
Jul 31, 2013 at 7:45 PM
Hi tibi225,

Can you point me to an example packet in a .pcap file?
Typically, ICMP packets are not UDP packets.

Boaz.
Aug 1, 2013 at 11:03 AM
Hi boaz,

I don't know what you mean by that. I have read more stuff about ICMP and you're right - ICMP is not UDP, nor TCP.
I'm working on UDP port scan and to a specific UDP message (I'm using payload to few ports as nmap does) I get ICMP Destination unreachable - port unreachable (type 3, code 3) packet. But this packet also contains UDP part - src, dst port, length and checksum.

I need to know to which port belongs obtained ICMP Destination unreachable messages. If you have any idea how to do that I will be really grateful.

Tibor.
Coordinator
Aug 2, 2013 at 2:02 PM
Hi Tibor,

If you can save a packet using Wireshark to a .pcap file and can point me to that file that can be helpful.
I believe that the following should work out for you:

IcmpDestinationUnreachableDatagram icmp = (IcmpDestinationUnreachableDatagram)(packet.Ethernet.IpV4.Icmp);
ushort destinationPort = icmp.IpV4.Udp.DestinationPort;

I hope this helps,

Boaz.
Aug 21, 2013 at 9:31 AM
Hi Boaz,

Thank you very much, it works as I needed.

Tibor