I have mangled ICMP traffic, but it is show some icmp protocols and the rest is TCP protocol in connection tracking.
illustration in screenshots…
Do you have explanation?
Thanks.
Mangle Rules:
Connection Tracking:
My understanding (which may be wrong):
The C in ICMP means “control”. So I would assume that your TCP connection has been routed through some network hop with reduced packet size, causing the MSS clamping mechanism to kick in - the TCP packet goes with “Don’t Fragment” flag, so when that network hop would normally fragment the packet into two, it instead sends back an ICMP message “fragmentation needed” informing the TCP sender about the available MTU, and the sender adjusts the packet size accordingly and tries again (overall this is more efficient than sending big packets and having each of them fragmented into two).
The ICMP packet mentioned above is considered part of that TCP connection, hence the connection mark assigned to the ICMP packet is attached to that connection although it is a TCP one.