The contents of this legacy page are no longer maintained nor supported, and are made available only for historical purposes.

Skitter Output Packets

Skitter sends ICMP echo requests. In the payload, we reserve 12 bytes at the start for kernel timestamping (FreeBSD). When not using our FreeBSD kernel timestamping, the next 8 bytes are used in the same manner as ping: they hold a timeval representing the time the packet was sent, filled with a gettimeofday() call from user space. The next 4 bytes hold the destination address. This is necessary because in the case of receiving an ICMP echo reply (where none of the original request packet will be present), the source address of the echo reply need not be the destination address of the echo request. For example, a box may transmit an echo reply via an interface that is different than the interface to which the echo request was sent, and may use the IP address of the transmitting interface as the source address in the echo reply.

Echo Request with Incrementing TTL

Below is a picture of the ICMP echo request sent by skitter The fields we fill from application space:
  • user transmit timeval in the payload
  • destination IP address in the payload
  • ttl in the header (via setsockopt(fd,IPPROTO_IP,IP_TTL,...))
  • all of the ICMP header fields (type, code, checksum, identifier and sequence number)

Related Objects

See https://catalog.caida.org/details/software/skitter/ to explore related objects to this document in the CAIDA Resource Catalog.
Published
Last Modified