有没有人注意过ping大包给google时会发生什么？

hahasasa

C:\>ping www.g.cn -t -l 1000

Pinging g.cn [203.208.39.99] with 1000 bytes of data:

Reply from 203.208.39.99: bytes=56 (sent 1000) time=62ms TTL=245
Reply from 203.208.39.99: bytes=56 (sent 1000) time=63ms TTL=245
Reply from 203.208.39.99: bytes=56 (sent 1000) time=101ms TTL=245
Reply from 203.208.39.99: bytes=56 (sent 1000) time=99ms TTL=245

Ping statistics for 203.208.39.99:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 62ms, Maximum = 101ms, Average = 81ms
Control-C
^C
C:\>ping www.g.cn -t -l 56

Pinging g.cn [203.208.37.99] with 56 bytes of data:

Reply from 203.208.37.99: bytes=56 time=41ms TTL=245

Ping statistics for 203.208.37.99:
    Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 41ms, Maximum = 41ms, Average = 41ms
Control-C
^C
C:\>ping www.g.cn -t -l 57

Pinging g.cn [203.208.39.104] with 57 bytes of data:

Reply from 203.208.39.104: bytes=56 (sent 57) time=42ms TTL=245
Reply from 203.208.39.104: bytes=56 (sent 57) time=42ms TTL=245

Ping statistics for 203.208.39.104:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 42ms, Maximum = 42ms, Average = 42ms
Control-C




回应总是只含56byte数据，似乎这么做能减小了恶意ping大包带来的带宽影响，可不知道是如何实现的。。。

ssffzz1

通常的ICMP实现是直接返回ICMP的填充字节。但是ICMP协议本身并为规定填充什么，以及如何返回。
g 这么做可能就是LZ猜测的原因，我想要实现这个目的的话肯定是修改多的内核参数，再说了通常像g这么大的网前端肯定有防火墙 F5之类的设备，估计这个结果是这些设备搞出来的。

hahasasa

第一次看到这种现象，比较好奇，呵呵！