> is "host %s unreachable" redundant? or some messup with the code..?
Some messup with the code, probably change 1.60 to "print-icmp.c":
revision 1.60
date: 2001/06/28 19:53:42; author: itojun; state: Exp; lines: +16 -17
no real need to pass char * to printf format string.
For those unreachables that it doesn't handle specially, it does
fmt = tok2str(unreach2str, "#%d",
dp->icmp_code);
(void)snprintf(buf, sizeof(buf), "%s %s unreachable",
fmt, ipaddr_string(&dp->icmp_ip.ip_dst));
to generate the format string, and "unreach2str" is
/* Formats for most of the ICMP_UNREACH codes */
static struct tok unreach2str[] = {
{ ICMP_UNREACH_NET, "net %s unreachable" },
{ ICMP_UNREACH_HOST, "host %s unreachable" },
{ ICMP_UNREACH_SRCFAIL,
"%s unreachable - source route failed" },
{ ICMP_UNREACH_NET_UNKNOWN, "net %s unreachable - unknown" },
{ ICMP_UNREACH_HOST_UNKNOWN, "host %s unreachable - unknown" },
{ ICMP_UNREACH_ISOLATED,
"%s unreachable - source host isolated" },
{ ICMP_UNREACH_NET_PROHIB,
"net %s unreachable - admin prohibited" },
{ ICMP_UNREACH_HOST_PROHIB,
"host %s unreachable - admin prohibited" },
{ ICMP_UNREACH_TOSNET,
"net %s unreachable - tos prohibited" },
{ ICMP_UNREACH_TOSHOST,
"host %s unreachable - tos prohibited" },
{ ICMP_UNREACH_FILTER_PROHIB,
"host %s unreachable - admin prohibited filter" },
{ ICMP_UNREACH_HOST_PRECEDENCE,
"host %s unreachable - host precedence violation" },
{ ICMP_UNREACH_PRECEDENCE_CUTOFF,
"host %s unreachable - precedence cutoff" },
{ 0, NULL }
};
For ICMP_UNREACH_HOST_PROHIB, "fmt" will be
"host %s unreachable - admin prohibited"
and the "snprintf" will make that
"host %s unreachable - admin prohibited {IP address}"
which will then be printed to the terminal with
(void)printf("icmp: %s", str);
producing the text you saw:
> 995545715.360878 < ip 72: 62.236.224.62 > 62.236.230.23: icmp: host
> %s unreachable - admin prohibited filter 193.166.3.2 unreachable for
> 62.236.230.23.4024 > 193.166.3.2.smtp: [|tcp]
> (DF) (ttl 67, id 47221, len 60) (ttl 254, id 43873, len 56)
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
