Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm customer of an Irish ISP, eircom, which has started censoring the pirate bay.

When I try to ping 194.71.107.15 which is the IP address of thepiratebay.com, I get this output:

PING 194.71.107.15 (194.71.107.15) 56(84) bytes of data.
From 159.134.124.176 icmp_seq=1 Packet filtered
From 159.134.124.176 icmp_seq=2 Packet filtered
From 159.134.124.176 icmp_seq=3 Packet filtered

How does ping know that's it's filtered? How can I learn more about how it's filtered. My ping/nmap foo is weak.

share|improve this question
add comment

6 Answers

up vote 5 down vote accepted

Ping determines its printed message depending on the ICMP control message it receives in response to an echo-request.

At a guess, I would imagine that whatever filtering device Eircom are using to block access to The Pirate Bay is generating either ICMP Type 3, Code 9 (network administratively prohibited) or Type 3, Code 10 (host administratively prohibited) messages in response to traffic directed to The Pirate Bay's IP address.

To confirm, I would suggest running a packet capture (using Wireshark or similar) and looking at the ICMP response packets you are receiving back from 159.134.124.176.

share|improve this answer
add comment

After looking at

ping.c from iputils-ping Debian etch package, I see:

 
 /*
 *
 * pr_icmph --
 *      Print a descriptive string about an ICMP header.
 */
void pr_icmph(__u8 type, __u8 code, __u32 info, struct icmphdr *icp)
{

...
                case ICMP_PKT_FILTERED:
                        printf("Packet filtered\n");
                        break;
...

It looks like iptables reject adds this in the response, see

http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/net/ipv4/netfilter/ipt%5FREJECT.c

and search for "ICMP_PKT_FILTERED", though it may not be the only case that would make ping reply with such message.

share|improve this answer
2  
+1 for the source diving. –  RainyRat Sep 1 '09 at 14:53
1  
Definitely. –  squillman Sep 1 '09 at 15:02
    
Another thing that can cause this is "private" packets (using a private/internal IP) that make it out to the world. I've seen this when a VPN connection dropped and packets going to 10.11.12.13 started getting "packet filtered" responses from an external system that they should never have gone to in the first place. See also en.wikipedia.org/wiki/IP_address#IPv4_private_addresses –  fencepost May 8 '12 at 16:14
add comment

That means that device 159.134.124.176 is blocking ICMP (Ping) packets and replying back to you with that information. The possible ICMP replies are listed in this Wiki article.

share|improve this answer
add comment

ping receives a ICMP_DEST_UNREACH and depending on the type of returned icmp package returned ping knows that it's filtered.

share|improve this answer
add comment

I think it means that 159.134.124.176 isn't allowing your pings to reach 194.71.107.15, i.e, it's filtering (at least) ICMP. When I do the same thing, I get:

\# ping 194.71.107.15
PING 194.71.107.15 (194.71.107.15) 56(84) bytes of data.
64 bytes from 194.71.107.15: icmp_seq=1 ttl=50 time=43.0 ms
64 bytes from 194.71.107.15: icmp_seq=2 ttl=50 time=42.0 ms
64 bytes from 194.71.107.15: icmp_seq=3 ttl=50 time=42.1 ms

...and a swift WHOIS tells me that 159.134.124.176 is indeed something owned by Eircom.

share|improve this answer
2  
The question was "how" ping knows, I think the author is aware that ICMP is being filtered. He probably thinks that filtered means filtering black hole style, with nothing given back and that raised the question about ping "magically" knowing what's the case. –  Karolis T. Sep 1 '09 at 14:45
add comment

The basic idea (and hopefully someone can help me to fill in some detail as I'm not a Linux expert) is that your ping is sending out an ICMP echo request but is not getting the standard echo reply back from the target host. Instead it was answered by 159.134.124.176, probably with some form of ICMP destination unreachable response. That and the fact that 159.134.124.176 is not the original target implies that the packets are filtered.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.