CODEWITHSUNDEEP
udpipsipwiresharkwireshark-dissector
somputer
somputer

Reputation: 245

Is there someone to explain double IP Header in UDP?

enter image description here

I got a upper pcap.

This pcap show me the double IP header.

10.10.10.10 -> 10.10.10.50
10.25.85.3 -> 10.25.87.52

I don't know why contain double IP header..

And I don't know when this used.

Is there someone to explain double IP Header in UDP?

Upvotes: 1

Views: 322

Answers (1)

Vladimir Ralev
Vladimir Ralev

Reputation: 1381

You can see the first IP header is protocol 4 (IP-in-IP) which is the encapsulation RFC https://www.rfc-editor.org/rfc/rfc2003 thus it carries another IP layer inside sort of a tunnel/VPN. The second IP header is normal UDP and from there everything continues normally. I am not sure if Wireshark is giving you a glitch parsing such packets when they are fragmented because some of the context in missing, however no mystery overall. You have encapsulation configured somewhere. It could be an artefact of your capture tool configuration.

Upvotes: 2

Related Questions