ICMP stands for Internet Control Message Protocol. It is primarily used by the operating systems of networked computers to send error messages indicating service status.

learn more… | top users | synonyms

0
votes
1answer
22 views

Linux PCs sending “ICMP udp port unreachable” to DNS server

So digging around in my syslog I have been noticing a lot of ICMP packets being flagged by our ASAs: %ASA-4-313005: No matching connection for ICMP error message: icmp src Internet:x.x.21.122 dst ...
0
votes
0answers
14 views

ICMP - How to send a timestamp and netmask request?

How can I submit a ICMP request for timestamp and netmask request to a host without using NMAP? Is it possible to generate a terminal / command line request with a tool like hping3 or any native ...
0
votes
0answers
20 views

ICMP packets in firewalld zones

How are the zones in firewalld configured w.r.t ICMP packets? and do they act differently for interfaces and sources? 1. How firewalld route ICMP packets? I would assume the main zones act as they ...
1
vote
1answer
65 views

Debian Linux default interface?

I have a Debian machine with an SNMP pooler running, but I am running into an issue with getting the pooler to use a specific interface. The Debian machine has 3 interfaces allow-hotplug eth0 iface ...
0
votes
1answer
53 views

centos doesn't reply to icmp request

I have the following situation: Centos7, 2 NIC with following setup: em2(NIC2) : 82.79.24.74/29 82.79.24.75/29 em3(NIC3) : 192.168.0.240/24 192.168.133.240/24 ...
0
votes
0answers
47 views

ICMP replies - ingress or egress interface (e.g. from a traceroute)

When a traceroute is initiated and receives an ICMP replies from the nodes, which interface should the be replying from according to RFC 1812. they are actually replying from ingress (where they ...
1
vote
2answers
59 views

Why woud ping fail but not traceroute

For a few days now I started making the interesting observation of a machine intermittently not responding to an ICMP ping, while it still responds to an ICMP based traceroute (specifically set via ...
1
vote
0answers
49 views

What should happen when receiving an ICMP Fragmentation Needed message?

In general, and in particular on a Solaris 10 machine ... See, we are having an issue in our network. I handle some reverse proxy instances on a Solaris 10 server that is behind a load balancer, and ...
2
votes
1answer
55 views

Outgoing packet has NATed src address

Configuration/Topology: There are 3 machines hadoop2 | hadoop | driver eth0 10.10.15.3 | eth0 10.10.15.2 | tap0 192.168.0.199 ...
0
votes
0answers
95 views

Timestamp response behaviors in different tools

I was testing out icmp time stamp response on one of my servers using ping and hping3. Here is result of hping3 # hping3 --icmp-ts x.x.x.x HPING x.x.x.x: icmp mode set, 28 headers + 0 data bytes ...
-1
votes
3answers
394 views

Why can i not ping my host behind the firewall. Cisco asa 5505 [closed]

Can anyone please help me to figure out what in my configuration of the Cisco asa 5505 is wrong or missing. I have multiple host behind my firewall these hosts run different websites on port 80. I am ...
0
votes
0answers
89 views

ARP/ICMP in a network environment with overlapping IP address

Currently I have lab network setup to mimic customer's network deployment. (According to the customer, they are using VRF over VLAN so that their customer can have overlapping network connecting to ...
1
vote
2answers
850 views

Block ICMP timestamp & timestamp reply with firewalld

OS: CentOS 7.0 Per the results of a security scan, it has been suggested that we block ICMP timestamp & timestamp reply messages using the firewall (CVE-1999-0524). I've used firewalld to set up ...
0
votes
1answer
42 views

IPv4 ICMP Codes/Errors for WAN transmissions

Can someone tell me which IPv4 ICMP Codes/Errors i have to unlock as Best Practise for WAN transmission (RedHat und Cisco)?
0
votes
0answers
51 views

How to manage overload of ICMP with PF?

I would like to make a basic managment of ICMP overload with packet filter on FreeBSD. The function I would like to realise is:     if target receive too many ICMP from a given source IP address,   ...
0
votes
2answers
309 views

Fastest way to scan all hosts that are online

I am looking to find all the hosts that are online in a set of networks. I would like to find all hosts that are online in the entire network of 170.10.. (there are ~64K possible hosts). The network ...
1
vote
2answers
805 views

Linux is sending ARP requests to hosts in other subnets?

Setup Host B <--> Router <--> Host A Host A: IP = 192.168.1.10, Net = 192.168.1.0/24, VLAN = 1, Default GW = 192.168.1.1 (Router) Host B: IP = 192.168.2.10, Net = 192.168.2.0/24, VLAN ...
0
votes
2answers
700 views

Test for ICMP/TCP timestamp responses and disable responses

We had a penetration test done on our servers and one of the vulnerabilities they suggested we fix is that the host responded to an ICMP timestamp request with TCP timestamp. I've looked around but ...
0
votes
0answers
405 views

Wierd traceroute / ICMP issues on Juniper SRX 210BE

I recently acquired Juniper SRX 210BE; until now I've been using Cisco ASA 5505 but I really want to switch over to Juniper world (big FreeBSD fan and all that). I've got FTTC (fiber to the cabnet) ...
1
vote
2answers
747 views

What would cause alternating “Request timed out.” and “Destination host unreachable.” when using ping command?

I am pinging a Windows 8.1 PC that is currently shut down and I'm getting alternating results "Request timed out." and "Destination host unreachable." What could cause this kind of behavior?
2
votes
5answers
753 views

iptables, ICMP and RELATED

I am using the following simple iptables rule that accepts related packets: -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT I am letting ICMP echo-requests pass with this other rule: ...
2
votes
0answers
56 views

How can I test an ICMP Re-direct message?

I want to test whether my linux machine is actually accepting ICMP re-direct message and updating the entry in routing table.This is what i have done so far to achieve the same. Simulated a ICMP ...
0
votes
0answers
119 views

What is causing this seemingly excessive ICMP traffic?

This seems to occur when I initiate a connection to an IP that I haven't previously before. Is this a botnet trying to say hi to his friends? As you can see I have an ip filter set in this image, ...
-7
votes
1answer
125 views

Is there a dedicated server that is legal to ping frequently with a massive number of devices? [closed]

I have thousands of devices and all of them need to have some kind of communication pass through them every couple of seconds to stay active. Pinging is sufficient for keeping the devices active. Are ...
2
votes
2answers
504 views

with fully permissive iptables, tcpdump shows icmp echo requests arriving, but no reply's are sent

I'm a bit stumped on where to look next. When using SoftEther IPsec VPN into my network, I can access every server in the main subnet but one. When behind the main firewall, the server responds to all ...
-4
votes
2answers
55 views

How to manage PING replies? [closed]

How can I manage, for example, my Ubuntu mashine so it doesn't (or does) respond to PING(ICMP ECHO_REQUEST - type 8) requests? Normally almost all computers in a LAN network responds to ping with an ...
1
vote
1answer
190 views

Did you see similar icmp ever? [closed]

ping ya.ru PING ya.ru (213.180.193.3) 56(84) bytes of data. 64 bytes from www.yandex.ru (213.180.193.3): icmp_req=1 ttl=60 time=97.6 ms 64 bytes from www.yandex.ru (213.180.193.3): icmp_req=2 ttl=60 ...
1
vote
0answers
343 views

Linux MIPS box: ICMP (ping) works, but TCP does not - how to fix it?

I'm trying to set up MIPS Linux box network. Here is it's configuration: ~ # ifconfig eth0 Link encap:Ethernet HWaddr CC:5D:4E:FF:45:7F inet addr:192.168.0.2 Bcast:192.168.0.255 ...
0
votes
1answer
67 views

Iptables REJECT doesn't let the ftp server list files

I had to comment these 2 lines in my iptables file, because for some reason it was denying ftp listing (it does connect to the ftp server, but it never lists the files and then it just times out): -A ...
2
votes
3answers
224 views

What is the “right way” to monitor network?

My production servers are kept at US east coast and some of the supporting apps are kept at Amsterdam in Europe. There is a Nagios instance running at US east coast as well which does a few port ...
1
vote
1answer
200 views

Prevent Linux from processing incoming ICMP Host unreachable packets

I have a test setup with one host on a network (10.1.0.0/16) talking via TCP to another one on another network (10.2.0.0/16) and a gateway in the middle. Sometimes, the TCP connection is lost and ...
0
votes
1answer
129 views

How can I proxy ICMP requests?

I have a ubuntu server that receives many ping requests from various other servers in the network. I would like to be able to proxy these requests. Using iptable rules I can see how to DROP or ACCEPT ...
0
votes
1answer
864 views

ICMP echo-reply packets with a much lower TTL (-190) than ICMP time-exceeded packets

When I ping the last three hops of a traceroute path to facebook.com from my location, the ICMP echo-reply packets I get back all have a TTL of respectively 58, 57 and 56. The hops in question are the ...
1
vote
2answers
180 views

ICMP and traceroute , How does ICMP keep a counter while it passess hops

When tracerouting a destination and going through all these hops, what happens during this process? Does ICMP have an initial counter and decrements this counter on each hop it passes? If the counter ...
0
votes
3answers
2k views

Test a server using MTR through TCP

Is it possible to use MTR over TCP? If not is there an alternative? I have done some research and I am not finding any way to do such a thing, so I'm wondering if anyone has had any experience with ...
0
votes
0answers
269 views

What does given filed mean in netstat -s on Linux

I am analyzing the the output of netstat -s and wanted to know what "input ICMP message failed" is meant for ,below is output of netstat -s Icmp: 643 ICMP messages received 0 input ICMP ...
1
vote
0answers
217 views

Only ICMP traffic allowed inbound on ISA Server 2006

I have recently set up a connection to a remote site. The connection between the sites is done at the ISP level (ie, this is not a B2B tunnel on ISA). I'm fairly lightweight in the networking realm, ...
3
votes
3answers
1k views

Reasons to turn off/on unreachables messages?

I see on this question (How can I stop Linux from sending ICMP "Destination Unreachable" responses?) that there was a lot of discussion pointing to the fact that you shouldn't turn off ICMP ...
-4
votes
1answer
687 views

How can I stop Linux from sending ICMP “Destination Unreachable” responses? [closed]

I have a Linux system which has a number of services disabled (for example, telnet). When a telnet client attempts a connection, the system responds with an ICMP "Destination Unreachable". Is there ...
1
vote
2answers
3k views

Why is ICMP categorized as a layer 3 protocol? [closed]

ICMP is categorized as a layer 3 protocol in the OSI model, but as far as i can tell it does not meet the definition of a network layer protocol. It does not provide addressing or packet routing (it ...
0
votes
2answers
6k views

Fragmentation and packet size,using tcpdump

i am trying to understand concept of fragmentation: i have two virtual machines with public ip connected to a switch. tracepath shows packet not going through gateway from vm1: Trying to send ...
0
votes
1answer
87 views

Why are there two types of ICMP Redirect?

Wikipedia lists 4 types of ICMP Redirect reasons: 0 Redirect for Network 1 Redirect for Host 2 Redirect for Type of Service and Network 3 Redirect for Type of Service and Host I understand ...
0
votes
2answers
718 views

How to properly drop ICMP type 3 packets on possible DDoS attack?

Even after running iptables -A INPUT -p icmp -m icmp --icmp-type 3 -j DROP I keep getting ICMP type 3 code 13 packets on tcpdump. when I run tcpdump icmp, I get messages like: 19:41:31.923630 IP ...
4
votes
2answers
2k views

Linux ping command exits early due to ICMP host unreachable

An automated script runs shutdown -r now on a machine, and after a 30s delay, uses ping to determine when the machine is available. I've recently switched the OS from Centos 5 to Oracle Linux 6 and ...
2
votes
2answers
4k views

Traceroute, ICMP, UDP and TCP

When does traceroute use TCP? Or does it just use UDP, also why does Traceroute use UDP on MacX and ICMP on windows? I thought ICMP just contains a message saying what caused the error of a packet and ...
0
votes
1answer
2k views

ICMP time exceeded in-transit

In the last few days my server suffers an attack of this kind: (bandwith > 60MBit/s, XXX.XXX.XXX.XXX are multiple IPs) tcpdump -n proto ICMP 17:15:19.267464 IP XXX.XXX.XXX.XXX > my_ip: ...
0
votes
0answers
188 views

Multihoming, NAT and ICMP

My router is the default gateway of a LAN and is multihomed. ISP2 is used for HTTP, HTTPS and ISP1, the default gateway of the default routing table, for the rest of the traffic. Similar questions ...
4
votes
1answer
699 views

tcpdump on interface when pinging nonexistent hosts on local network

I've statically configured the IP address of an interface on a server: ip addr add 10.40.0.6/16 broadcast 10.40.255.255 dev eth1 If I try to ping a machine on the network (e.g., 10.40.0.1), it ...
0
votes
2answers
145 views

Restricting ICMP using iptables

I have the following rule,which i believe will restrict icmp packets to 1/s. :INPUT DROP [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [7:988] -A INPUT -i lo -j ACCEPT -A INPUT -p icmp -m icmp ...
0
votes
2answers
178 views

Caculating packet offset

In Wireshark, if I want to write a filter which accepts only ICMP destination unreachable ( type 3 ) messages, the filter is icmp[0] == 3 . How do I count the packet offset of 0 in this instance ? ...