Decode ICMP embedded flows - show which packet actually triggered an error

Destination Unreachable, Time Exceeded, Redirect, Source Quench, and
Parameter Problem (plus their ICMPv6 equivalents) all carry, after
their own fixed header, as much of the packet that triggered the
error as the network could fit - always at least its IP header plus
the first 8 bytes of payload, exactly enough to recover TCP/UDP port
numbers. That embedded flow is the actual reason an ICMP error shows
up in a capture at all, and wasn't shown before this.

Reuses parse_ipv4()/parse_ipv6() directly on the embedded bytes rather
than a separate parser - it's a genuine (if truncated) IP packet, not
a different format. Two small is_error_type() helpers gate which ICMP
types this is attempted for, since echo/timestamp/Neighbor Discovery
types don't carry an embedded packet at all.

Live-verified with a real traceroute to 8.8.8.8 captured on wlp1s0:
genuine Time Exceeded messages from real intermediate routers - this
machine's own gateway, then real ISP infrastructure several hops out
- all correctly showing the flow that triggered them, matching
traceroute's own hop output.

2 files changed, 81 insertions, 0 deletions

diff --git a/include/packeteer/net/icmp.hpp b/include/packeteer/net/icmp.hpp
index d2613a2..60fd1d7 100644
--- a/include/packeteer/net/icmp.hpp
+++ b/include/packeteer/net/icmp.hpp
@@ -1,11 +1,14 @@
 #pragma once
 
 #include <cstdint>
+#include <cstdio>
 #include <optional>
 #include <span>
 #include <string>
 
 #include "packeteer/byteio.hpp"
+#include "packeteer/net/ipv4.hpp"
+#include "packeteer/net/ipv6.hpp"
 
 // ICMPv4 (RFC 792) and ICMPv6 (RFC 4443) share the same first-4-byte
 // shape (Type, Code, Checksum) but a completely different type
@@ -36,6 +39,22 @@ inline std::optional<IcmpHeader> parse_icmpv4(std::span<const unsigned char> byt
     return header;
 }
 
+// Destination Unreachable, Source Quench, Redirect, Time Exceeded, and
+// Parameter Problem are the ICMPv4 types that carry an embedded
+// original packet (RFC 792) - everything else (echo, timestamp)
+// doesn't, so icmpv4_embedded_flow() is only worth trying for these.
+inline bool icmpv4_is_error_type(std::uint8_t type) {
+    return type == 3 || type == 4 || type == 5 || type == 11 || type == 12;
+}
+
+// Destination Unreachable, Packet Too Big, Time Exceeded, and
+// Parameter Problem for ICMPv6 (RFC 4443) - echo and the various
+// Neighbor Discovery types (Router/Neighbor Solicitation/
+// Advertisement, Redirect) don't carry an embedded packet at all.
+inline bool icmpv6_is_error_type(std::uint8_t type) {
+    return type == 1 || type == 2 || type == 3 || type == 4;
+}
+
 inline std::string icmpv4_type_name(std::uint8_t type) {
     switch (type) {
         case 0: return "Echo Reply";
@@ -81,4 +100,60 @@ inline std::string icmpv6_type_name(std::uint8_t type) {
     }
 }
 
+namespace detail {
+inline std::string icmp_ipv4_to_string(const Ipv4Address& addr) {
+    char buf[16];
+    std::snprintf(buf, sizeof(buf), "%u.%u.%u.%u", addr.bytes[0], addr.bytes[1], addr.bytes[2],
+                  addr.bytes[3]);
+    return buf;
+}
+}  // namespace detail
+
+// Destination Unreachable, Time Exceeded, Redirect, and Parameter
+// Problem all carry, after their own fixed 8-byte header, as much of
+// the packet that triggered the error as the network could fit --
+// always at least its IP header plus the first 8 bytes of payload
+// (RFC 792/4443), exactly enough to recover TCP/UDP port numbers. This
+// is what actually answers "which flow got this error", the reason an
+// ICMP error shows up in a capture in the first place. Reuses
+// parse_ipv4() directly on those bytes rather than a separate parser:
+// it's a genuine (if truncated) IPv4 packet, not a different format.
+inline std::optional<std::string> icmpv4_embedded_flow(std::span<const unsigned char> icmp_bytes) {
+    if (icmp_bytes.size() < 8) return std::nullopt;
+    auto ip = parse_ipv4(icmp_bytes.subspan(8));
+    if (!ip) return std::nullopt;
+
+    std::string out = detail::icmp_ipv4_to_string(ip->header.src) + " -> " +
+                       detail::icmp_ipv4_to_string(ip->header.dst) +
+                       " proto=" + std::to_string(ip->header.protocol);
+    if ((ip->header.protocol == kProtoTcp || ip->header.protocol == kProtoUdp) &&
+        ip->payload.size() >= 4) {
+        out += " (" + std::to_string(read_be16(ip->payload, 0)) + " -> " +
+               std::to_string(read_be16(ip->payload, 2)) + ")";
+    }
+    return out;
+}
+
+// Same idea for ICMPv6, over the embedded IPv6 packet's fixed 40-byte
+// header. Extension headers on the embedded packet aren't walked (see
+// walk_ipv6_extension_headers() in ipv6.hpp for the full version this
+// deliberately doesn't reuse here) - an embedded packet's next_header
+// naming an extension header rather than TCP/UDP directly is rare
+// enough in practice not to be worth the extra complexity for a
+// nested, best-effort field.
+inline std::optional<std::string> icmpv6_embedded_flow(std::span<const unsigned char> icmp_bytes) {
+    if (icmp_bytes.size() < 8) return std::nullopt;
+    auto ip6 = parse_ipv6(icmp_bytes.subspan(8));
+    if (!ip6) return std::nullopt;
+
+    std::string out = ipv6_to_string(ip6->header.src) + " -> " + ipv6_to_string(ip6->header.dst) +
+                       " next=" + std::to_string(ip6->header.next_header);
+    if ((ip6->header.next_header == kProtoTcp || ip6->header.next_header == kProtoUdp) &&
+        ip6->payload.size() >= 4) {
+        out += " (" + std::to_string(read_be16(ip6->payload, 0)) + " -> " +
+               std::to_string(read_be16(ip6->payload, 2)) + ")";
+    }
+    return out;
+}
+
 }  // namespace packeteer::net
diff --git a/include/packeteer/summarize.hpp b/include/packeteer/summarize.hpp
index c538cec..4126eb5 100644
--- a/include/packeteer/summarize.hpp
+++ b/include/packeteer/summarize.hpp
@@ -218,6 +218,10 @@ inline std::string summarize_transport_and_above(const IpInfo& info) {
             if (icmp->identifier) {
                 out += " id=" + std::to_string(*icmp->identifier) +
                        " seq=" + std::to_string(*icmp->sequence);
+            } else if (net::icmpv4_is_error_type(icmp->type)) {
+                // Answers the actual reason this error shows up in a
+                // capture: which flow triggered it.
+                if (auto flow = net::icmpv4_embedded_flow(info.payload)) out += " [" + *flow + "]";
             }
         }
     } else if (info.proto == net::kProtoIgmp) {
@@ -234,6 +238,8 @@ inline std::string summarize_transport_and_above(const IpInfo& info) {
             if (icmp->identifier) {
                 out += " id=" + std::to_string(*icmp->identifier) +
                        " seq=" + std::to_string(*icmp->sequence);
+            } else if (net::icmpv6_is_error_type(icmp->type)) {
+                if (auto flow = net::icmpv6_embedded_flow(info.payload)) out += " [" + *flow + "]";
             }
         } else {
             out += " | ICMPv6";  // truncated: at least say what it is