IP header identification field is zero, why?

IP header identification field is zero, why?

[thomas yang]

This is captured on my PC (Fedora 11, Linux）

[root@localhost ~]# tcpdump -i eth1 icmp -n -x
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
17:02:39.025882 IP 192.168.1.64 > 192.168.1.1: ICMP echo request, id
25096, seq 1, length 64
	0x0000:  4500 0054 0000 4000 4001 b717 c0a8 0140
......
17:02:39.027866 IP 192.168.1.64 > 192.168.1.1: ICMP echo request, id
25096, seq 2, length 64
	0x0000:  4500 0054 0000 4000

The  IP header 'identification' field is zero, why?

I wrote a simple UDP server and UDP client programs, and captured some
packets, the IP identification is also zero.

Should the host increase this field for each packet it sends?


I captured some TCP packets, all of the IP identification are
different, not zero.


--
thomas

Re: IP header identification field is zero, why?

[Eric Dumazet]

thomas yang a écrit :
> This is captured on my PC (Fedora 11, Linux）
> 
> [root@localhost ~]# tcpdump -i eth1 icmp -n -x
> tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
> listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
> 17:02:39.025882 IP 192.168.1.64 > 192.168.1.1: ICMP echo request, id
> 25096, seq 1, length 64
> 	0x0000:  4500 0054 0000 4000 4001 b717 c0a8 0140
> ......
> 17:02:39.027866 IP 192.168.1.64 > 192.168.1.1: ICMP echo request, id
> 25096, seq 2, length 64
> 	0x0000:  4500 0054 0000 4000
> 
> The  IP header 'identification' field is zero, why?
> 
> I wrote a simple UDP server and UDP client programs, and captured some
> packets, the IP identification is also zero.
> 
> Should the host increase this field for each packet it sends?
> 
> 
> I captured some TCP packets, all of the IP identification are
> different, not zero.
> 

Very good questions, this bothered me too.


ping sends "echo request" datagrams with DF set (Dont Fragment),
and ID=0, this is a user program building a packet from scratch.

When linux replies with a "echo reply", DF is not set and an ID is included
in the answer, increasing at each packet.

About your UDP tests, DF is automatically set, and
I believe ID on DF frames is generated only for connected sockets.

cf include/net/ip.h

static inline void ip_select_ident(struct iphdr *iph, struct dst_entry *dst, struct sock *sk)
{
        if (iph->frag_off & htons(IP_DF)) {
                /* This is only to work around buggy Windows95/2000
                 * VJ compression implementations.  If the ID field
                 * does not change, they drop every other packet in
                 * a TCP stream using header compression.
                 */
                iph->id = (sk && inet_sk(sk)->daddr) ?
                                        htons(inet_sk(sk)->id++) : 0;
        } else
                __ip_select_ident(iph, dst, 0);
}

Re: IP header identification field is zero, why?

[thomas yang]

> ping sends "echo request" datagrams with DF set (Dont Fragment),
> and ID=0, this is a user program building a packet from scratch.
>
> When linux replies with a "echo reply", DF is not set and an ID is included
> in the answer, increasing at each packet.
>
> About your UDP tests, DF is automatically set, and
> I believe ID on DF frames is generated only for connected sockets.
>

The IP ID for TCP is non-zero, but for UDP is zero,  strange.

I want to make the IP ID (not always zero) for UDP packets, what should I do?
(I want to use 'IP header ID, flags, offset, protocol' to identify an
IP packets)

Re: IP header identification field is zero, why?

[Eric Dumazet]

thomas yang a écrit :

> The IP ID for TCP is non-zero, but for UDP is zero,  strange.
> 
> I want to make the IP ID (not always zero) for UDP packets, what should I do?
> (I want to use 'IP header ID, flags, offset, protocol' to identify an
> IP packets)

As I said, you can connect() your udp socket, if you send/receive trafic to/from a given destination.

if (connected_sock)
	res = connect(sock, (struct sockaddr *)&addr, sizeof(addr));

(Only once)


Then, your sendto() can be faster (because no route lookup is performed)

   if (sendto(sock, buffer, psize, 0,
                  connected_socks ? NULL : (struct sockaddr *)&addr,
                                   sizeof(struct sockaddr_in)) != -1)

Then linux *will* generate an ID for each datagram.