ICMP Chain

This module contains the ICMPChain flow analysis chain which can be used by PATHspider’s Observer for recording ICMPv4 [RFC792] and ICMPv6 [RFC4443] details.

pathspider.chains.icmp.ICMP4_TTLEXCEEDED = 11

ICMPv4 Message Type - TTL Exceeded

pathspider.chains.icmp.ICMP4_UNREACHABLE = 3

ICMPv4 Message Type - Unreachable

pathspider.chains.icmp.ICMP6_TTLEXCEEDED = 3

ICMPv6 Message Type - Time Exceeded

pathspider.chains.icmp.ICMP6_UNREACHABLE = 1

ICMPv6 Message Type - Unreachable

class pathspider.chains.icmp.ICMPChain[source]

This flow analysis chain records details of ICMP messages in the flow record. It will record when a message of certain types have been seen during a flow.

Field Name

Type

Meaning

icmp_unreachable

bool

An ICMP unreachable message was seen in the reverse direction

icmp4(rec, ip, q, rev)[source]

Records ICMPv4 details.

ICMPv4 Unreachable Messages

Sets icmp_unreachable to True if an ICMP Unreachable message is seen in the reverse direction.

Parameters
  • rec (dict) – the flow record

  • ip (plt.ip) – the IPv4 packet that was observed to be part of this flow and contained an ICMPv4 header

  • q (plt.ip) – the ICMP quotation of the packet that triggered this message (if any)

  • rev (bool) – True if the packet was in the reverse direction, False if in the forward direction

Returns

False if an ICMP unreachable message has been observed, otherwise True

Return type

bool

icmp6(rec, ip6, q, rev)[source]

Records ICMPv6 details.

ICMPv6 Unreachable Messages

Sets icmp_unreachable to True if an ICMP Unreachable message is seen in the reverse direction.

Parameters
  • rec (dict) – the flow record

  • ip (plt.ip6) – the IPv6 packet that was observed to be part of this flow and contained an ICMPv6 header

  • q (plt.ip) – the ICMP quotation of the packet that triggered this message (if any)

  • rev (bool) – True if the packet was in the reverse direction, False if in the forward direction

Returns

False if an ICMP unreachable message has been observed, otherwise True

Return type

bool

new_flow(rec, ip)[source]

For a new flow, all fields will be initialised to False.

Parameters
  • rec (dict) – the flow record

  • ip (plt.ip or plt.ip6) – the IP or IPv6 packet that triggered the creation of a new flow record

Returns

Always True

Return type

bool