I think "ICMP No Reply Found Issue" should have been on-topic

Question

First, let me say no disrespect to Ron here. I just think this is the kind of question that is good for us. We have many questions closed as off-topic (for good reason), but this is the kind I think we should embrace. I also think its good to support router developers with our knowledge of the RFCs.

I've answered the OPs question in the comments. The action requested here is that we consider questions about packet captures and whether they are RFC-compliant on-topic as long as they are not educational (we don't do people's homework!).

New user @cajenh asked the following question ICMP No Reply Found Issue

Currently working on a Go based NAT router and when translating ICMP traffic and am seeing some interesting behavior.

The clients request is forwarded to the server, the server keeps track of the internal IP and the clients ICMP ID, uses an open ICMP ID from the server, changes fields in the packet and forwards it to the external address (in this case 8.8.8.8).

When the server receives the response it looks up what internal IP, MAC, and ICMP ID to the external ICMP packet ID and forwards it back to the client.

I am likely missing something basic because I am too close to the issue but any help would be appreciated. If the packet is malformed in some way that I have not recognized then I will be able to adjust the code accordingly.

Request sent from client

(included image of wireshark capture of ICMP echo request)

Reply sent from server after receiving outside reply

(included image of wireshark capture of ICMP echo reply)

@ronMaupin closed the question as off-topic with the following explanation:

Unfortunately, your question is off-topic here. You can ask about programming on Stack Overflow, where there are many network-savvy programmers. The only thing I can see is that your return IP packet may have a bad checksum, and that would cause the destination to drop it (technically, the router should not forward a packet with a bad checksum)..

A discussion ensued between Ron and cajenh about whether it was on or off topic. I'll include the full discussion below since Ron made his argument in that thread.

I believe the question should be on-topic because it was asking why the ICMP echo-reply was not considered a reply by Wireshark (I found a 792 RFC violation, but was only able to provide the answer in a comment). That falls under design or theory of protocols used to operate a network (e.g. IP, TCP, routing protocols, STP, etc);

The one good case Ron may have is that the homemade Go router is not "vendor supported". hardware that has a paid support option from the manufacturer (enterprise/provider class products, some small business class devices);

Frankly, I love questions where people send in two captured packets and ask what's wrong with them "RFC-wise" (as long as it's not educational). I think we should encourage and allow that type of question. Especially to support our router-developer brethren.

Continued discussion on original question: (sadly this went too back-and-forth too quickly)

My question is in regards to purely the pcap supplied I was simply giving context. The checksum should be recalculated on each packet being sent so that should not be an issue. If you would like me to move the topic I can but I am asking a networking question currently not a programming question. – cajenh

Unfortunately, your network device (a router you are building) is off-topic here, as are questions about what your host/server does. You really will not find anyone here to answer the question beyond what I have already said in my comments, and the "should" you postulate for the recalculation cannot be determined as you have the validation disabled in the second screenshot. In any case, using an on-topic, enterprise-grade router would perform properly unless there is an off-topic host problem. – Ron Maupin

I am only looking for a second opinion on a PCAP sample provided nothing else, if you would like me to state that explicitly I can but I don't understand why the pure mention of it being being sent from a home-brewed product is action for removing. I am not asking on how to fix the server or the host in any way, purely if there is a red flag in the PCAPs provided. If you would like to continue the conversation regarding the checksum portion of my network question then please unlock the post as it is a networking question and answer. – cajenh

I am simply trying to point you to a place where you will get some action on your question. Your question will just languish here, and nobody will answer it. That is not what you want, and it is not what the community here wants. Remember that, "NE is a site for to ask and provide answers about professionally managed networks in a business environment." – Ron Maupin

Where is the appropriate section to post a question regarding a packet capture. – cajenh

I am not an expert on every SE site, and there is not a site for every question. Personally, if I was trying to debug the code on my homegrown router, I would ask on Stack Overflow, as I have already explained. There are many network-savvy programmers there. – Ron Maupin

Look I'll stop arguing with you, I understand where you are coming from but as I have stated numerous times I am simply looking for a second pair of eyes at a PCAP and the section dedicated to network engineering is the most relevant in my eyes. I offered to edit the post to conform to the sections guidelines as well. Have a good day. I am not looking for debugging help in any way. – cajenh

Answer 1

The OP could have followed the directions and edited the question to be on-topic. The way the questions was asked that the problem was either the host or the home-built router, both of which are off-topic.

Properly, the question could have been edited to ask about the protocol theory. The OP offered, but never edited the question. If the question had been edited to conform then it could have been reopened, but it seemed the OP would rather argue than edit.

Answer 2

Not sure I would have marked this as off topic personally, but I would definitely have considered voting as unclear what the post was asking since it didn't actually ask any questions.

Were they looking for an RFC reference? Where the code was wrong? Examples of working ICMP code to compare to theirs? How the Wireshark dissector was making the determination that "No reply was found" for the ICMP request? Something else entirely?

While you can make some inferences about what response was desired, this is by no means certain without further clarification (which was done in comments, not the original post). The post could have (and should have) been edited to make it clear what was actually being asked of the community.

And that being the case, I very seldom re-open a closed post simply to close it for another reason (I believe the only times I have done this, the question had multiple reasons for closing and was edited to address only the specific close reason).