In the case of a ping message (echo request/reply), the ICMP payload section contains an additional 8-byte timestamp value. This value is not a part of the ICMP header; it is used by ping to compute the RTT of the message. If you select the timestamp field in your capture, you wi...
whereas Telnet packets (TCP port 23) with the same source and destination addresses are forwarded to Pigpen. Echo Reply packets (ICMP type 0), which do not find a match in the policy route, are routed normally.