Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm dropping all ICMP type 8 packets on the INPUT chain and so now I'm seeing log entries as a Fabric script tries to contact another server, like this:

kernel: INPUT DROP IN=eth0 OUT= SRC=<ip1> DST=<ip2> LEN=88 TOS=0x00 PREC=0xC0 TTL=50 ID=60964 PROTO=ICMP TYPE=3 CODE=3 [SRC=<ip2> DST=<ip1> LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=45897 DF PROTO=TCP SPT=34120 DPT=22022 WINDOW=14600 RES=0x00 SYN URGP=0 ]

However they're different to the tcp/udp log entries I'm used to, specifically the section in square braces. What do it's different parts relate to?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

That's a destination unreachable (type 3) port unreachable (code 3) message. As such, it encapsulates some data about the original connection that generated the message, which is what you see in the angle brackets. So IP1 tried to connect to ip2, via TCP, from source port 34120, to destination port 22022, etc. That generated an ICMP destination unreachable message, which you then dropped.

I would, as a side note, think very carefully about blocking all ICMP traffic. It's usually not a good idea.

share|improve this answer
    
Sorry I should have clarified that I'm blocking type 8 specifically, I'll update the question. I'm now allowing type 3 and the fabric script is working. Thanks for the explanation! –  ghickman Apr 5 '11 at 15:53
    
@ghickman IMO at the very least, you should allow types 3, 11, and 12. –  pepoluan Apr 6 '11 at 0:26
    
@pepoluan Could you clarify your reasoning for types 11 and 12? Would you suggest any other types on top of those three and why? –  ghickman Apr 6 '11 at 9:03
    
@ghickman Type 11 (Time Exceeded) helps cut down TCP timeout if the packets happen to enter a routing loop. If it's filtered out, the sending side will just assume packet is dropped, and attempt retransmission... again and again until TCP times out (which might take a looooong time). Type 12 (Parameter Problem) might help if, e.g., some clients can connect, but some others can't, due to some incompatible protocol settings. –  pepoluan Apr 6 '11 at 12:46
    
@ghickman you might also allow Type 30 (Traceroute - RFC1393) if you provide a publicly-accessible server. Although I am not aware of any network-tool using it :-/ –  pepoluan Apr 6 '11 at 12:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.