Bug 21992

Summary: FreeBSD 4.x Bug with ICMP Error Messages
Product: Base System Reporter: ofir <ofir>
Component: miscAssignee: freebsd-bugs (Nobody) <bugs>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: Unspecified   
Hardware: Any   
OS: Any   

Description ofir 2000-10-14 22:10:01 UTC 
It is long known that FreeBSD uses a wrong IP Identification number
with its ICMP Error Messages. This fact was discovered by Fyodor
long ago.

I wish to identify were the problem is.

The next example is with FreeBSD 4.1:

00:52:19.055758 ppp0 > x.x.x.x.1393 > y.y.y.y.0: udp 0 [tos 0x8]  
(ttl 64, id 58965)
			 4508 001c e655 0000 4011 3f63 xxxx xxxx
			 yyyy yyyy 0571 0000 0008 a55c

00:52:19.464548 ppp0 < y.y.y.y > x.x.x.x: icmp: y.y.y.y udp port 0 
unreachable Offending pkt: x.x.x.x.1393 > y.y.y.y.0: udp 0 [tos 0x8]  
(ttl 47, id 21990, bad cksum 5063!) (ttl 238, id 27639)
			 4500 0038 6bf7 0000 ee01 0bbd yyyy yyyy
			 xxxx xxxx 0303 87f3 0000 0000 4508 001c
			 55e6 0000 2f11 5063 xxxx xxxx yyyy yyyy
			 0571 0000 0008 0000

A udp datagram sent to a closed udp port (port 0, can be any port). 
The original udp datagram used e655 hex as its IP Identification 
field value. The echoed IP Header inside the ICMP Error message 
states that this value was 55e6 (with the offending datagram).

FreeBSD 4.x simply flips between the first 8bits to the second 8
bits.

How-To-Repeat: hping2 -2 IP_Address_of_FBSD_machine
Comment 1 George Reid 2000-10-15 02:27:17 UTC 
This was fixed in 4.1.1-RELEASE - ip_id is stored in host byte order in
4.x whereas it should be stored in network byte order as in 4.1.1. This is
why the byte appears to be backwards.

George Reid
services@nevernet.net
Comment 2 ru freebsd_committer freebsd_triage 2000-10-16 08:40:55 UTC 
State Changed
From-To: open->closed

Duplicate of PR#16240, which has been fixed a month ago.