# $Id: echoReply.txt,v 1.1 2001/05/24 03:34:43 pcharles Exp $
ICMP Echo Reply

00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00 
00 54 00 11 00 00 ff 01 bd 95 7f 00 00 01 7f 00 
00 01 00 00 43 f6 f7 03 00 00 68 c8 05 3b 60 ff 
0b 00 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 
16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 
26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35
36 37


ICMP Echo Reply decoded..

                         link level ethernet header
00 00 00 00 00 00          MAC destination address
00 00 00 00 00 00          MAC source address
08 00                      ethernet type field (0x800 - ip datagram)
                         ip header
45                         header length and version (0x4 - IPv4, 0x5 - len)
00                         type of service
00 54                      total length minus eth header (0x54 - 84 bytes)
00 11                      identification, unique id of this datagram
00 00                      3-bit flags (0x0), 13-bit fragment offset (0x000)
ff                         time to live (TTL)
01                         protocol (0x01 - ICMP)
bd 95                      header checksum
7f 00 00 01                source IP address (- 127.0.0.1)
7f 00 00 01                destination IP address (- 127.0.0.1)
                         icmp header
00                         icmp_type - type of message (0x00 - echo reply)
00                         icmp_code - type subcode
43 f6                      icmp_cksum - 1's complement checksum of struct

f7 03 00 00              struct timeval

68 c8 05 3b 60 ff 0b 00  padding (aka. data payload.. ping default 56 bytes)
08 09 0a 0b 0c 0d 0e 0f
10 11 12 13 14 15 16 17 
18 19 1a 1b 1c 1d 1e 1f 
20 21 22 23 24 25 26 27 
28 29 2a 2b 2c 2d 2e 2f 
30 31 32 33 34 35 36 37
