In the Decoding IP headers recipe of this chapter, we created a decodeIp() function that decoded the IP headers of a packet. If the protocol type was ICMP in that function, we called a decodeICMP() function. We will create the decodeICMP() function in this recipe.
Even though our layer diagram shows the ICMP packet as a part of the Internet layer, from the libpcap point of view, it is a part of the third layer (Protocol layer) of our header stack; this is because the IP header encapsulates the ICMP header.
The ICMP header looks like this:
The components are explained as follows:
ICMP Type: This field identifies the ICMP message type. The Echo request message is type
8and the Echo reply is type0.Code: This field is not used in the Echo request or reply so this is set to
0.Checksum: This field contains the checksum for the ICMP header.
Identifier: This is the identification field that can be used to match the Echo request with an Echo reply.