ICMP stands for Internet Control Message Protocol. It is primarily used by the operating systems of networked computers to send error messages indicating service status.
0
votes
0answers
29 views
Why doesn’t BSD deliver ICMP network unreachable errors anylonger? [closed]
In TCP/IP illustrated, Section 9.3, it is written:
Older implementations of the BSD TCP/IP software generated either a
host unreachable, or a network unreachable, depending on whether the
...
0
votes
2answers
75 views
Fragmentation and packet size,using tcpdump
i am trying to understand concept of fragmentation:
i have two virtual machines with public ip connected to a switch.
tracepath shows packet not going through gateway
from vm1:
Trying to send ...
0
votes
1answer
37 views
Why are there two types of ICMP Redirect?
Wikipedia lists 4 types of ICMP Redirect reasons:
0 Redirect for Network
1 Redirect for Host
2 Redirect for Type of Service and Network
3 Redirect for Type of Service and Host
I understand ...
0
votes
2answers
58 views
How to properly drop ICMP type 3 packets on possible DDoS attack?
Even after running
iptables -A INPUT -p icmp -m icmp --icmp-type 3 -j DROP
I keep getting ICMP type 3 code 13 packets on tcpdump. when I run tcpdump icmp, I get messages like:
19:41:31.923630 IP ...
2
votes
0answers
63 views
Linux ping command exits early due to ICMP host unreachable
An automated script runs shutdown -r now on a machine, and after a 30s delay, uses ping to determine when the machine is available. I've recently switched the OS from Centos 5 to Oracle Linux 6 and ...
0
votes
2answers
66 views
Traceroute, ICMP, UDP and TCP
When does traceroute use TCP? Or does it just use UDP, also why does Traceroute use UDP on MacX and ICMP on windows? I thought ICMP just contains a message saying what caused the error of a packet and ...
0
votes
0answers
36 views
ICMP time exceeded in-transit
In the last few days my server suffers an attack of this kind:
(bandwith > 60MBit/s, XXX.XXX.XXX.XXX are multiple IPs)
tcpdump -n proto ICMP
17:15:19.267464 IP XXX.XXX.XXX.XXX > my_ip: ...
0
votes
0answers
42 views
Multihoming, NAT and ICMP
My router is the default gateway of a LAN and is multihomed. ISP2 is used for HTTP, HTTPS and ISP1, the default gateway of the default routing table, for the rest of the traffic.
Similar questions ...
4
votes
1answer
61 views
tcpdump on interface when pinging nonexistent hosts on local network
I've statically configured the IP address of an interface on a server:
ip addr add 10.40.0.6/16 broadcast 10.40.255.255 dev eth1
If I try to ping a machine on the network (e.g., 10.40.0.1), it ...
0
votes
2answers
52 views
Restricting ICMP using iptables
I have the following rule,which i believe will restrict icmp packets to 1/s.
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [7:988]
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -m icmp ...
0
votes
0answers
38 views
Caculating packet offset
In Wireshark, if I want to write a filter which accepts only ICMP destination unreachable ( type 3 ) messages, the filter is icmp[0] == 3 .
How do I count the packet offset of 0 in this instance ?
...
0
votes
0answers
68 views
ICMP ping one way only?
I have 2 W7 hosts (may be others, I haven't checked yet) that are on the network, and can ping the domain controller. They can also ping each other. Yet when I'm on the server, the ping request ...
2
votes
5answers
346 views
Generating ICMP packets when TTL=2?
By inspecting the payload of ICMP time-exceeded packets, I noticed that sometimes it is the last but one router (when ttl=2 in the returned packet) or even a previous one(up to 5 hops before, ttl=5) ...
1
vote
1answer
145 views
pfsense: all interfaces up, but all non default gateways down
I am seeing some strange behavior in pfSense 2.0.3 in which all of my WAN interfaces are up according to the Interfaces screen, yet all but the default gateway are shown as "Offline" in gateway ...
2
votes
2answers
111 views
Can't ping multihoned Linux machine on non-default interface
I have a multihoned Ubuntu server with a set of interfaces that includes:
eth2: 10.10.0.131/24
eth3: 10.20.0.2/24
The default interface is eth2, with a gateway of 10.10.0.1. Here's what the routing ...
0
votes
1answer
69 views
Security zones regarding ICMP Flood Attacks
I found this statement describing ICMP Flood attacks and I am confused about the term "Security Zone" being used in it.
" Once the ICMP threshold is reached, the server will stop accepting any ...
1
vote
1answer
115 views
What exactly do --limit 1/s and --limit-burst mean in iptables rules?
centos 5.x
I'm trying to wrap my mind around the following iptables rule on one of my servers:
-A RH-Firewall-1-INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
On another ...
0
votes
2answers
55 views
Multiple ICMP destination unreachable messages
I'm load testing some web services hosted on IIS7. The web services make network calls to underlying services in response to client requests. The client requests are simple HTTP requests but the ...
4
votes
7answers
185 views
Scan for connected, powered on computers on a network?
I want to scan for powered on computers on my LAN and gather logs about that. I tried nmap but it didn't work very well (a lot of switched on computers are not getting detected).
nmap -sP ...
1
vote
1answer
73 views
ICMP rate-limit on time-exceeded messages
How can I set ICMP rate-limiting in a Cisco router?
Here on the manual page they only talk about ICMP unreachable messages:
ip icmp rate-limit unreachable [df] [ms] [log [packets] [interval-ms]]
...
1
vote
2answers
84 views
Understanding how Tracert works
From what I gathered so far, Tracert works by sending 3 ICMP echo messages. Starting with a TTL value of 1. For each router the packet encounters, the TTL value will be decremented. For the 1st ...
1
vote
1answer
75 views
Cisco ASA 5500 - Internet connection dies when adding ICMP exception to firewall
When I add ICMP to be allowed both on inside / outside interfaces the internet connection dies. Does anyone know why this happens?
I kind of observed that this behavior takes place not just for ICMP.
...
3
votes
1answer
302 views
Nmap ping scan over a VPN tunnel return all hosts alive?
I'm curious as to why running an nmap -sP (ping scan) on a remote subnet linked via a Cisco site-to-site IPSec tunnel returns "host up" status for every IP in the range.
[root@xt ~]# nmap -sP ...
0
votes
0answers
89 views
Is timeout in tracertoutput an indication of an error?
TCP/IP packages sent from my computer to a remote server does not always reach destination and ends up being retransmitted sometimes several times before they succeed.
To troubleshoot this, I'm ...
2
votes
0answers
95 views
ICMP Redirect Theory VS. Application
I'm trying to watch ICMP redirects in a lab using Cisco Packet Tracer (version 5.3.2) and I'm not seeing them, which leads me to believe that either my lab configuration isn't correct or my ...
3
votes
1answer
69 views
How can I tell if a host is bridged and acting as a router
I would like to scan my DMZ for hosts that are bridged between subnets and have routing enabled. Since I have everything from VMWare servers, to load balancers on the DMZ I'm unsure if every host is ...
1
vote
0answers
87 views
Disable response from outside interface on ASA 5505 while allowing ping (and response from outside) on the inside interface?
On the ASA 5505 How do I allow icmp requests out (and responses back in) while not allowing a response from the outside interface when pinged.
0
votes
1answer
99 views
Ubuntu stops responding to ping from random clients
I got a ubuntu server running redmine from apache.
My clients, can access redmine, but stops responding random, and other clients, can browse redmine fine, when the client with the problem cant ...
4
votes
4answers
577 views
How to stop a ICMP attack?
We are under a heavy icmp flood attack. Tcpdump shows the result below. Altough we have blocked ICMP with iptables tcpdump still prints icmp packets. I've also attached iptables configuration and ...
1
vote
0answers
500 views
Why is my CentOS box rejecting some (but not all) ICMP ping requests from the same remote host?
CentOS 4.x
I've got several old CentOS 4.x systems and have configured iptables to allow ICMP traffic.
Originally, I had an iptables rule that looked like:
-A RH-Firewall-1-INPUT -p icmp ...
4
votes
1answer
897 views
Stop duplicate icmp echo replies when bridging to a dummy interface?
I recently configured a bridge br0 with members as eth0 (real if) and dummy0 (dummy.ko if).
When I ping this machine, I receive duplicate replies as:
# ping SERVERA
PING SERVERA.domain.local ...
2
votes
1answer
194 views
Can i stop tcp handshake by send icmp of unreachable host
This is what happened:
client - send syn
server - send icmp (unreachable host [i also try to add code =10] )
wait for 100 ms
send syn-ack
client - send ack in response to the ...
0
votes
1answer
97 views
What is causing ping sweep?
I am spotting ping sweeps on our firewall log originating from our Windows 2003 SP2 x64 server.
The traffic shows sequential pings sent to private ranges only. Eg:
192.168.1.1
192.168.1.2
192.168.1.3
...
3
votes
1answer
201 views
How does the ping command differentiate between its ICMP responses and anothers?
If I have two shells open each pinging the same host, how do the two shells differentiate between the ICMP responses coming back for each shell?
0
votes
0answers
241 views
ICMP ping size stops working at 1272 bytes
I am pinging between two servers. These are both connected with 100Mbps ethernet NICs to the same switch. As you can see from the results below, I can ping from one to the other giving an ICMP data ...
4
votes
3answers
288 views
Is it normal for AD authentication to generate a lot of ICMP traffic?
is it normal for AD authentication between a workstation and AD server to generate a lot of ICMP traffic? I have a network intrusion prevention in place that is constantly detecting huge amount of ...
0
votes
1answer
123 views
Nagios dropping ICMP packets
I am running a Nagios server on vmware 4.0 and every now and again during the day it alerts that some of servers cannot be reached via ICMP, clearly staging that a certain percentage of packets send ...
7
votes
2answers
2k views
Why do ICMP Redirect Host happen?
I'm setting up a Debian box as a router for 4 subnets. For that I have defined 4 virtual interfaces on the NIC where the LAN is connected (eth1).
eth1 Link encap:Ethernet HWaddr ...
-1
votes
2answers
462 views
freebsd dmesg has a lot of “Limiting icmp unreach response from 1293 to 200 packets/sec”
I has a simple freebsd 9.0 machine.But everytime i start my freebsd and use command dmesg. There aren't any hardware information there but full of
"Limiting icmp unreach response from 1293 ...
2
votes
1answer
119 views
Can fragments of a packet be refragmented again?
In IPv4, fragmentation is done by routers on way to the destination if DF(do not fragment) flag is not set in the IP packet.
Once a packet is fragmented, its fragments may take different paths (due ...
-1
votes
2answers
896 views
What is the difference between flow control and congestion control at layer 2 and 3? [closed]
Is there a difference between flow control and congestion control at the following layers?
layer 2(data link layer)
layer 3(network layer)
If they are not same, then how is each handled at the ...
-2
votes
2answers
2k views
What happens when ARP Request comes from a different subnet?
What will happen when an ARP Request packet is sent from router1 to router2 in the following two cases? Will an ARP Reply be generated or the ARP Request packet be dropped?
...
1
vote
1answer
227 views
What is the effect of stale ARP cache entry on traffic to that DIP till the entry ages out of the ARP table?
If the host, for which an ARP table entry is present on the connected router, has changed its NIC(so that its MAC address has changed), what will happen when a packet is sent out on the link with the ...
0
votes
1answer
239 views
Pros vs Cons of Rate Limiting ICMP
I am configuring Config Server Firewall and here is the default config for ICMP.
I have read on the internet that disabling or limiting ICMP can cause huge headaches on your server. However I have ...
3
votes
3answers
3k views
Denying ICMP type 3 code 4 traffic - good or bad?
Investigating a slow VPN connection (Cisco ASA IPSec) to a remote office, I noticed on our firewall a lot of access rule matches:
Denied ICMP type=3, code=4 from *ip_address* on interface outside
I ...
10
votes
2answers
2k views
Does traceroute use UDP or ICMP or both?
When I do a trace on the www.google.com domain from my laptop, am I using icmp or udp ?
I thought it was icmp type 11 but while searching for something else I came across rules where icmp type 30 was ...
1
vote
1answer
569 views
Can i change the default AWS EC2 Public DNS?
I'm using Route 53 and created A record to the Elastic IP that associated with an instance.
In Security Group, i activated the "All ICMP" and make it accessible from anywhere (0.0.0.0/0) so i can ...
2
votes
3answers
774 views
What is the best server or Ip address to use for prolonged testing?
I usually run uptime/latency tests against (and from) two servers that we own at different sites and until recently I've used the google dns servers as a control group.
However, I've realized there ...
0
votes
0answers
154 views
Issue with ICMP ping Echo reply
My application is testing devices connectivity using ping ICMP functionality. It is working fine for all devices except for a particular device that is CISCO wireless controller. I am not able to ...
1
vote
0answers
242 views
Where is HP Procurve route type “ICMP” coming from?
I've got the following test network:
Architecture:
edge_a: 192.168.e.1 [edge vlan] (edge switch, no acl) [admin vlan] 192.168.m.1/24
core: 192.168.m.2/24 [admin vlan] (core router, yes acl) ...
