I'm playing around with raw socket programming and IP header spoofing.

If I run the following in my Python console with Scapy, I can see an ICMP echo request and reply in Wireshark and with a C program that sniffs ICMP packets entering and leaving my system.

>>> from scapy.all import *
>>> send( IP()/ICMP()/b'abcdef' )

However, if I set an incorrect IP header length field like below, I only see a ICMP echo request in Wireshark, no reply, and I don't see output from the packet sniffing program.

>>> from scapy.all import *
>>> send( IP(len=4000)/ICMP()/b'abcdef' )

I'm guessing that the Linux kernel drops packets with invalid IP header "Total Length" fields. Can I somehow stop my system from dropping these packets? It's not important if my machine responds to these packets, but I want to be able to access the content of these packets programmatically.

1 Answer 1


The Internet Protocol (IP) is defined in RFC 791. The RFC specifies the format of the IP header. In the header there is the IHL (Internet Header Length) field which is 4 bits long and specifies the header length in 32 bit words. The IHL field can hold values from 0 (Binary 0000) to 15 (Binary 1111).

the longest Internet Header (IP header) size can be 15*32 Bits = 480 Bits = 60 Bytes.

the shortest header size is 20 bytes, where the Internet Header field has the value 5 (0101). This is because all the required fields in the header need 20 Bytes of space.

  • This doesn't really answer my question - I'm trying to make my system not drop packets with incorrect IP headers.
    – jeppe
    Apr 3, 2022 at 12:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .