On Sep 18, 2009, at 2:49 PM, Maynard, Chris wrote:
Yes, but RFC 792 also says in the Introduction:
ICMP, uses the basic support of IP as if it were a higher
level protocol, however, ICMP is actually an integral part of IP,
and
must be implemented by every IP module.
So if ICMP is technically an integral part of IP, then it follows that
ICMP should use the byte ordering as defined by Appendix B of RFC 791
... shouldn't it?
It's clear that the intent was to increment the sequence #, so IMO,
Windows got it completely wrong in this case.
Would it help to introduce something similar to the relative TCP
sequence numbers in the TCP dissector? I know it seems like a lot of
work to work around weirdness in Windows, but it's something to think
about.
Steve