帮忙看看ICMP Destination unreachable (Port unreachable)

发布于 2022-09-29 12:37:08 字数 32556 浏览 7 评论 0

用tethereal -V icmp 抓到如下包，不明白ip 与icmp和udp里面源IP和目的IP怎么会不一样呢？
Frame 14 (112 bytes on wire, 112 bytes captured)
Arrival Time: Jun  1, 2007 17:06:00.217863000
Time delta from previous packet: 0.000909000 seconds
Time since reference or first frame: 1.146602000 seconds
Frame Number: 14
Packet Length: 112 bytes
Capture Length: 112 bytes
Protocols in frame: eth:ip:icmp:ip:udp:dns
Ethernet II, Src: Netscree_58:6f:47 (00:10:db:58:6f:47), Dst: Intel_62:a4:2c (00:0e:0c:62:a4:2c)
Destination: Intel_62:a4:2c (00:0e:0c:62:a4:2c)
      Address: Intel_62:a4:2c (00:0e:0c:62:a4:2c)
      .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
      .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Source: Netscree_58:6f:47 (00:10:db:58:6f:47)
      Address: Netscree_58:6f:47 (00:10:db:58:6f:47)
      .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
      .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Type: IP (0x0800)
Internet Protocol, Src: 202.191.120.3 (202.191.120.3), Dst: 10.30.1.9 (10.30.1.9)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00)
      1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30)
      .... ..0. = ECN-Capable Transport (ECT): 0
      .... ...0 = ECN-CE: 0
Total Length: 98
Identification: 0x59f4 (2302
Flags: 0x00
      0... = Reserved bit: Not set
      .0.. = Don't fragment: Not set
      ..0. = More fragments: Not set
Fragment offset: 0
Time to live: 241
Protocol: ICMP (0x01)
Header checksum: 0x20fd [correct]
      Good: True
      Bad : False
Source: 202.191.120.3 (202.191.120.3)
Destination: 10.30.1.9 (10.30.1.9)
Internet Control Message Protocol
Type: 3 (Destination unreachable)
Code: 3 (Port unreachable)
Checksum: 0x4b2a [correct]
Internet Protocol, Src: 10.30.1.9 (10.30.1.9), Dst: 202.191.120.3 (202.191.120.3)
      Version: 4
      Header length: 20 bytes
      Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
         0000 00.. = Differentiated Services Codepoint: Default (0x00)
         .... ..0. = ECN-Capable Transport (ECT): 0
         .... ...0 = ECN-CE: 0
      Total Length: 70
      Identification: 0x0000 (0)
      Flags: 0x04 (Don't Fragment)
         0... = Reserved bit: Not set
         .1.. = Don't fragment: Set
         ..0. = More fragments: Not set
      Fragment offset: 0
      Time to live: 50
      Protocol: UDP (0x11)
      Header checksum: 0xfabd [correct]
         Good: True
         Bad : False
      Source: 10.30.1.9 (10.30.1.9)
      Destination: 202.191.120.3 (202.191.120.3)
User Datagram Protocol, Src Port: 33480 (33480), Dst Port: domain (53)
      Source port: 33480 (33480)
      Destination port: domain (53)
      Length: 50
      Checksum: 0x0661 [correct]
Domain Name System (query)
      Transaction ID: 0xe213
      Flags: 0x0010 (Standard query)
         0... .... .... .... = Response: Message is a query
         .000 0... .... .... = Opcode: Standard query (0)
         .... ..0. .... .... = Truncated: Message is not truncated
         .... ...0 .... .... = Recursion desired: Don't do query recursively
         .... .... .0.. .... = Z: reserved (0)
         .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
      Questions: 1
      Answer RRs: 0
      Authority RRs: 0
      Additional RRs: 1
      Queries
         scm.aktel.com: type CNAME, class IN
            Name: scm.aktel.com
            Type: CNAME (Canonical name for an alias)
            Class: IN (0x0001)
      Additional records
         <Root>: type OPT
            Name: <Root>
            Type: OPT (EDNS0 option)
            UDP payload size: 4096
            Higher bits in extended RCODE: 0x0
            EDNS0 version: 0
            Z: 0x8000
                  Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
                  Bits 1-15: 0x0 (reserved)
            Data length: 0

Frame 15 (138 bytes on wire, 138 bytes captured)
Arrival Time: Jun  1, 2007 17:06:00.274794000
Time delta from previous packet: 0.056931000 seconds
Time since reference or first frame: 1.203533000 seconds
Frame Number: 15
Packet Length: 138 bytes
Capture Length: 138 bytes
Protocols in frame: eth:ip:icmp:ip:udp:nbns
Ethernet II, Src: Intel_62:a4:2c (00:0e:0c:62:a4:2c), Dst: All-HSRP-routers_1e (00:00:0c:07:ac:1e)
Destination: All-HSRP-routers_1e (00:00:0c:07:ac:1e)
      Address: All-HSRP-routers_1e (00:00:0c:07:ac:1e)
      .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
      .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Source: Intel_62:a4:2c (00:0e:0c:62:a4:2c)
      Address: Intel_62:a4:2c (00:0e:0c:62:a4:2c)
      .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
      .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Type: IP (0x0800)
Internet Protocol, Src: 10.30.1.9 (10.30.1.9), Dst: 10.44.41.114 (10.44.41.114)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00)
      1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30)
      .... ..0. = ECN-Capable Transport (ECT): 0
      .... ...0 = ECN-CE: 0
Total Length: 124
Identification: 0x9549 (38217)
Flags: 0x00
      0... = Reserved bit: Not set
      .0.. = Don't fragment: Not set
      ..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: ICMP (0x01)
Header checksum: 0xa5b3 [correct]
      Good: True
      Bad : False
Source: 10.30.1.9 (10.30.1.9)
Destination: 10.44.41.114 (10.44.41.114)
Internet Control Message Protocol
Type: 3 (Destination unreachable)
Code: 3 (Port unreachable)
Checksum: 0x3c1f [correct]
Internet Protocol, Src: 10.44.41.114 (10.44.41.114), Dst: 10.30.1.9 (10.30.1.9)
      Version: 4
      Header length: 20 bytes
      Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
         0000 00.. = Differentiated Services Codepoint: Default (0x00)
         .... ..0. = ECN-Capable Transport (ECT): 0
         .... ...0 = ECN-CE: 0
      Total Length: 96
      Identification: 0x4fa6 (20390)
      Flags: 0x00
         0... = Reserved bit: Not set
         .0.. = Don't fragment: Not set
         ..0. = More fragments: Not set
      Fragment offset: 0
      Time to live: 122
      Protocol: UDP (0x11)
      Header checksum: 0xb222 [correct]
         Good: True
         Bad : False
      Source: 10.44.41.114 (10.44.41.114)
      Destination: 10.30.1.9 (10.30.1.9)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
      Source port: netbios-ns (137)
      Destination port: netbios-ns (137)
      Length: 76
      Checksum: 0xbb01 [correct]
NetBIOS Name Service
      Transaction ID: 0x8263
      Flags: 0x4000 (Refresh)
         0... .... .... .... = Response: Message is a query
         .100 0... .... .... = Opcode: Refresh (
         .... ..0. .... .... = Truncated: Message is not truncated
         .... ...0 .... .... = Recursion desired: Don't do query recursively
         .... .... ...0 .... = Broadcast: Not a broadcast packet
      Questions: 1
      Answer RRs: 0
      Authority RRs: 0
      Additional RRs: 1
      Queries
         WANGY<20>: type NB, class IN
            Name: WANGY<20> (Server service)
            Type: NB
            Class: IN
      Additional records
         WANGY<20>: type NB, class IN
            Name: WANGY<20> (Server service)
            Type: NB
            Class: IN
            Time to live: 3 days, 11 hours, 20 minutes
            Data length: 6
            Flags: 0x6000 (H-node, unique)
                  0... .... .... .... = Unique name
                  .11. .... .... .... = H-node
            Addr: 10.44.41.114

Frame 16 (138 bytes on wire, 138 bytes captured)
Arrival Time: Jun  1, 2007 17:06:00.465699000
Time delta from previous packet: 0.190905000 seconds
Time since reference or first frame: 1.394438000 seconds
Frame Number: 16
Packet Length: 138 bytes
Capture Length: 138 bytes
Protocols in frame: eth:ip:icmp:ip:udp:nbns
Ethernet II, Src: Intel_62:a4:2c (00:0e:0c:62:a4:2c), Dst: All-HSRP-routers_1e (00:00:0c:07:ac:1e)
Destination: All-HSRP-routers_1e (00:00:0c:07:ac:1e)
      Address: All-HSRP-routers_1e (00:00:0c:07:ac:1e)
      .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
      .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Source: Intel_62:a4:2c (00:0e:0c:62:a4:2c)
      Address: Intel_62:a4:2c (00:0e:0c:62:a4:2c)
      .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
      .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Type: IP (0x0800)
Internet Protocol, Src: 10.30.1.9 (10.30.1.9), Dst: 10.40.182.86 (10.40.182.86)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00)
      1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30)
      .... ..0. = ECN-Capable Transport (ECT): 0
      .... ...0 = ECN-CE: 0
Total Length: 124
Identification: 0x2860 (10336)
Flags: 0x00
      0... = Reserved bit: Not set
      .0.. = Don't fragment: Not set
      ..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: ICMP (0x01)
Header checksum: 0x85bc [correct]
      Good: True
      Bad : False
Source: 10.30.1.9 (10.30.1.9)
Destination: 10.40.182.86 (10.40.182.86)
Internet Control Message Protocol
Type: 3 (Destination unreachable)
Code: 3 (Port unreachable)
Checksum: 0xc8ff [correct]
Internet Protocol, Src: 10.40.182.86 (10.40.182.86), Dst: 10.30.1.9 (10.30.1.9)
      Version: 4
      Header length: 20 bytes
      Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
         0000 00.. = Differentiated Services Codepoint: Default (0x00)
         .... ..0. = ECN-Capable Transport (ECT): 0
         .... ...0 = ECN-CE: 0
      Total Length: 96
      Identification: 0xa13d (41277)
      Flags: 0x00
         0... = Reserved bit: Not set
         .0.. = Don't fragment: Not set
         ..0. = More fragments: Not set
      Fragment offset: 0
      Time to live: 122
      Protocol: UDP (0x11)
      Header checksum: 0xd3aa [correct]
         Good: True
         Bad : False
      Source: 10.40.182.86 (10.40.182.86)
      Destination: 10.30.1.9 (10.30.1.9)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
      Source port: netbios-ns (137)
      Destination port: netbios-ns (137)
      Length: 76
      Checksum: 0x40ae [correct]
NetBIOS Name Service
      Transaction ID: 0xc4ed
      Flags: 0x4000 (Refresh)
         0... .... .... .... = Response: Message is a query
         .100 0... .... .... = Opcode: Refresh (
         .... ..0. .... .... = Truncated: Message is not truncated
         .... ...0 .... .... = Recursion desired: Don't do query recursively
         .... .... ...0 .... = Broadcast: Not a broadcast packet
      Questions: 1
      Answer RRs: 0
      Authority RRs: 0
      Additional RRs: 1
      Queries
         NETNJ107053D1<20>: type NB, class IN
            Name: NETNJ107053D1<20> (Server service)
            Type: NB
            Class: IN
      Additional records
         NETNJ107053D1<20>: type NB, class IN
            Name: NETNJ107053D1<20> (Server service)
            Type: NB
            Class: IN
            Time to live: 3 days, 11 hours, 20 minutes
            Data length: 6
            Flags: 0x6000 (H-node, unique)
                  0... .... .... .... = Unique name
                  .11. .... .... .... = H-node
            Addr: 10.40.182.86

Frame 17 (70 bytes on wire, 70 bytes captured)
Arrival Time: Jun  1, 2007 17:06:00.528493000
Time delta from previous packet: 0.062794000 seconds
Time since reference or first frame: 1.457232000 seconds
Frame Number: 17
Packet Length: 70 bytes
Capture Length: 70 bytes
Protocols in frame: eth:ip:icmp:ip:udp
Ethernet II, Src: FerranSc_7b:f0:00 (00:d0:00:7b:f0:00), Dst: Intel_62:a4:2c (00:0e:0c:62:a4:2c)
Destination: Intel_62:a4:2c (00:0e:0c:62:a4:2c)
      Address: Intel_62:a4:2c (00:0e:0c:62:a4:2c)
      .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
      .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Source: FerranSc_7b:f0:00 (00:d0:00:7b:f0:00)
      Address: FerranSc_7b:f0:00 (00:d0:00:7b:f0:00)
      .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
      .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Type: IP (0x0800)
Internet Protocol, Src: 10.16.17.65 (10.16.17.65), Dst: 10.30.1.9 (10.30.1.9)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
      0000 00.. = Differentiated Services Codepoint: Default (0x00)
      .... ..0. = ECN-Capable Transport (ECT): 0
      .... ...0 = ECN-CE: 0
Total Length: 56
Identification: 0x5f49 (24393)
Flags: 0x00
      0... = Reserved bit: Not set
      .0.. = Don't fragment: Not set
      ..0. = More fragments: Not set
Fragment offset: 0
Time to live: 125
Protocol: ICMP (0x01)
Header checksum: 0xb804 [correct]
      Good: True
      Bad : False
Source: 10.16.17.65 (10.16.17.65)
Destination: 10.30.1.9 (10.30.1.9)
Internet Control Message Protocol
Type: 3 (Destination unreachable)
Code: 3 (Port unreachable)
Checksum: 0xfaf2 [correct]
Internet Protocol, Src: 10.30.1.9 (10.30.1.9), Dst: 10.16.17.65 (10.16.17.65)
      Version: 4
      Header length: 20 bytes
      Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
         0000 00.. = Differentiated Services Codepoint: Default (0x00)
         .... ..0. = ECN-Capable Transport (ECT): 0
         .... ...0 = ECN-CE: 0
      Total Length: 71
      Identification: 0x0000 (0)
      Flags: 0x04 (Don't Fragment)
         0... = Reserved bit: Not set
         .1.. = Don't fragment: Set
         ..0. = More fragments: Not set
      Fragment offset: 0
      Time to live: 61
      Protocol: UDP (0x11)
      Header checksum: 0x172f [correct]
         Good: True
         Bad : False
      Source: 10.30.1.9 (10.30.1.9)
      Destination: 10.16.17.65 (10.16.17.65)
User Datagram Protocol, Src Port: domain (53), Dst Port: 4719 (4719)
      Source port: domain (53)
      Destination port: 4719 (4719)
      Length: 51
      Checksum: 0xef32

Frame 18 (70 bytes on wire, 70 bytes captured)
Arrival Time: Jun  1, 2007 17:06:00.574838000
Time delta from previous packet: 0.046345000 seconds
Time since reference or first frame: 1.503577000 seconds
Frame Number: 18
Packet Length: 70 bytes
Capture Length: 70 bytes
Protocols in frame: eth:ip:icmp:ip:udp
Ethernet II, Src: FerranSc_7b:f0:00 (00:d0:00:7b:f0:00), Dst: Intel_62:a4:2c (00:0e:0c:62:a4:2c)
Destination: Intel_62:a4:2c (00:0e:0c:62:a4:2c)
      Address: Intel_62:a4:2c (00:0e:0c:62:a4:2c)
      .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
      .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Source: FerranSc_7b:f0:00 (00:d0:00:7b:f0:00)
      Address: FerranSc_7b:f0:00 (00:d0:00:7b:f0:00)
      .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame
      .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address
Type: IP (0x0800)
Internet Protocol, Src: 10.61.67.27 (10.61.67.27), Dst: 10.30.1.9 (10.30.1.9)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
      0000 00.. = Differentiated Services Codepoint: Default (0x00)
      .... ..0. = ECN-Capable Transport (ECT): 0
      .... ...0 = ECN-CE: 0
Total Length: 56
Identification: 0x36ba (14010)
Flags: 0x00
      0... = Reserved bit: Not set
      .0.. = Don't fragment: Not set
      ..0. = More fragments: Not set
Fragment offset: 0
Time to live: 123
Protocol: ICMP (0x01)
Header checksum: 0xb08c [correct]
      Good: True
      Bad : False
Source: 10.61.67.27 (10.61.67.27)
Destination: 10.30.1.9 (10.30.1.9)
Internet Control Message Protocol
Type: 3 (Destination unreachable)
Code: 3 (Port unreachable)
Checksum: 0x5690 [correct]
Internet Protocol, Src: 10.30.1.9 (10.30.1.9), Dst: 10.61.67.27 (10.61.67.27)
      Version: 4
      Header length: 20 bytes
      Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
         0000 00.. = Differentiated Services Codepoint: Default (0x00)
         .... ..0. = ECN-Capable Transport (ECT): 0
         .... ...0 = ECN-CE: 0
      Total Length: 64
      Identification: 0x0000 (0)
      Flags: 0x04 (Don't Fragment)
         0... = Reserved bit: Not set
         .1.. = Don't fragment: Set
         ..0. = More fragments: Not set
      Fragment offset: 0
      Time to live: 59
      Protocol: UDP (0x11)
      Header checksum: 0xe72e [correct]
         Good: True
         Bad : False
      Source: 10.30.1.9 (10.30.1.9)
      Destination: 10.61.67.27 (10.61.67.27)
User Datagram Protocol, Src Port: domain (53), Dst Port: 3053 (3053)
      Source port: domain (53)
      Destination port: 3053 (3053)
      Length: 44
      Checksum: 0x9a1e