# ICMP Chain

This module contains the ICMPChain flow analysis chain which can be used by PATHspider’s Observer for recording ICMPv4 [RFC792] and ICMPv6 [RFC4443] details.

pathspider.chains.icmp.ICMP4_TTLEXCEEDED = 11

  ICMPv4 Message Type - TTL Exceeded

pathspider.chains.icmp.ICMP4_UNREACHABLE = 3

  ICMPv4 Message Type - Unreachable

pathspider.chains.icmp.ICMP6_TTLEXCEEDED = 3

  ICMPv6 Message Type - Time Exceeded

pathspider.chains.icmp.ICMP6_UNREACHABLE = 1

  ICMPv6 Message Type - Unreachable

class pathspider.chains.icmp.ICMPChain

  This flow analysis chain records details of ICMP messages in the flow record. It will record when a message of certain types have been seen during a flow.

  Field Name | Type | Meaning
  --- | --- | ---
  `icmp_unreachable` | bool | An ICMP unreachable message was seen in the reverse direction

  icmp4(rec, ip, q, rev)

    Records ICMPv4 details.

    ICMPv4 Unreachable Messages

      Sets `icmp_unreachable` to `True` if an ICMP Unreachable message is seen in the reverse direction.

    Parameters

      - rec (dict) – the flow record

      - ip (plt.ip) – the IPv4 packet that was observed to be part of this flow and contained an ICMPv4 header

      - q (plt.ip) – the ICMP quotation of the packet that triggered this message (if any)

      - rev (bool) – `True` if the packet was in the reverse direction, `False` if in the forward direction

    Returns

      `False` if an ICMP unreachable message has been observed, otherwise `True`

    Return type

      bool

  icmp6(rec, ip6, q, rev)

    Records ICMPv6 details.

    ICMPv6 Unreachable Messages

      Sets `icmp_unreachable` to `True` if an ICMP Unreachable message is seen in the reverse direction.

    Parameters

      - rec (dict) – the flow record

      - ip (plt.ip6) – the IPv6 packet that was observed to be part of this flow and contained an ICMPv6 header

      - q (plt.ip) – the ICMP quotation of the packet that triggered this message (if any)

      - rev (bool) – `True` if the packet was in the reverse direction, `False` if in the forward direction

    Returns

      `False` if an ICMP unreachable message has been observed, otherwise `True`

    Return type

      bool

  new_flow(rec, ip)

    For a new flow, all fields will be initialised to `False`.

    Parameters

      - rec (dict) – the flow record

      - ip (plt.ip or plt.ip6) – the IP or IPv6 packet that triggered the creation of a new flow record

    Returns

      Always `True`

    Return type

      bool