Question

I’m playing around with Scapy and I noticed something weird.

If I create a packet in order to trigger an ICMP time-exceeded error message:

myPacket = IP(dst="www.google.com", ttl=3)/TCP()

… I do get the ICMP message once I send it with the function sr .

On the other hand, if I take any outgoing packet that I have sniffed and change its ttl value to the same used above, I get no reply whatsoever.

What’s the problem here? I thought I could experience this by using dummy traffic, not real traffic! I even tried with other TTL values, but to no avail.

Answer 1

Ok, packets were getting dropped because once I changed the ttl value the checksum wasn’t correct any more. I just had to force the checksum to be computed again by deleting its value:

del(mypacket.getlayer(IP).chksum)