ICMP stands for Internet Control Message Protocol. It is primarily used by the operating systems of networked computers to send error messages indicating service status.

learn more… | top users | synonyms

0
votes
1answer
1k views

Linux PCs sending “ICMP udp port unreachable” to DNS server

So digging around in my syslog I have been noticing a lot of ICMP packets being flagged by our ASAs: %ASA-4-313005: No matching connection for ICMP error message: icmp src Internet:x.x.21.122 dst ...
0
votes
1answer
151 views

ICMP replies - ingress or egress interface (e.g. from a traceroute)

When a traceroute is initiated and receives an ICMP reply from the nodes, which interface should the be replying be from according to RFC 1812. they are actually replying from ingress (where they ...
2
votes
1answer
60 views

A non-recoverable error occurred during a database lookup

Short version: Why does Test-Connection report "A non-recoverable error occurred during a database lookup" for an offline host on a different subnet? I'm using PowerShell to ping a remote host with ...
3
votes
2answers
6k views

Traceroute, ICMP, UDP and TCP

When does traceroute use TCP? Or does it just use UDP, also why does Traceroute use UDP on MacX and ICMP on windows? I thought ICMP just contains a message saying what caused the error of a packet and ...
11
votes
3answers
24k views

Why do ICMP Redirect Host happen?

I'm setting up a Debian box as a router for 4 subnets. For that I have defined 4 virtual interfaces on the NIC where the LAN is connected (eth1). eth1 Link encap:Ethernet HWaddr ...
-1
votes
1answer
34 views

Manually sent ICMP redirect packets [closed]

I'm trying to sent a ICMP redirect to my router to add a new route, as I can not configure it from the portal, and have no access to it though telnet/ssh. The scenario is the next. LAN network ...
1
vote
2answers
47 views

Do NATs rewrite ipAddress in payload of ICMP packets?

Today when I test running a tracert command (windows + Wireshark) I see a outbound ICMP_ECHO_REQUEST packet that has sourceIP as "192.168.1.55" - my local IPAddress. It is followed by a ...
2
votes
2answers
2k views

Linux is sending ARP requests to hosts in other subnets?

Setup Host B <--> Router <--> Host A Host A: IP = 192.168.1.10, Net = 192.168.1.0/24, VLAN = 1, Default GW = 192.168.1.1 (Router) Host B: IP = 192.168.2.10, Net = 192.168.2.0/24, VLAN ...
0
votes
1answer
41 views

Why are ICMP packets not captured on the target interface?

I have a network setup as in the picture: The central box is a gateway (Ubuntu 15.10) which relays the packets betwen the various networks (only one is shown on the picture - lan0) and Internet. ...
7
votes
1answer
847 views

Forwarding traffic from TUN device (C++ backend) to the default gateway

The following problem is just a piece of the bigger solution I have a problem with. All other elements seem working so far, so I'll try to describe very small piece which I have problem with. I've ...
1
vote
1answer
55 views

Cannot ping through one of the network interfaces

Setup ubuntu linux VM ( virtual-box) is configured with two interfaces, eth0 and eth1. eth0 is on a bridged network and directly connected to external network. eth1 is on "nat network", which is ...
4
votes
7answers
3k views

Scan for connected, powered on computers on a network?

I want to scan for powered on computers on my LAN and gather logs about that. I tried nmap but it didn't work very well (a lot of switched on computers are not getting detected). nmap -sP ...
2
votes
0answers
32 views

TCP Handshake fails when ICMP Redirects are enabled

So it seems that due to ICMP redirects it's not possible to connect to a server behind a VPN connection. It immediately responds with a TCP RST (with manifests itself in SSH as ...
1
vote
0answers
65 views

Sending Ping at fixed packet size as jumbo frame is not working in linux

I have to hosts connected each other with ipv4 address each other. I modified the MTU of each one to 9000. Then I want to send a Ping request at fixed packet size +1500 to verify that can send and ...
-1
votes
1answer
99 views

Default gateway and ARP confusion

I have the following configuration (I'd post a pic but not enough rep for more than 2): PC1 (10.0.2.10/24) and PC2 (10.0.2.137/29) are connected to a hub, which is connected to a router on interface ...
0
votes
1answer
98 views

ICMP - How to send a timestamp and netmask request?

How can I submit a ICMP request for timestamp and netmask request to a host without using NMAP? Is it possible to generate a terminal / command line request with a tool like hping3 or any native ...
3
votes
2answers
145 views

seeing remote MTUs of 250 and 68. is this ever valid?

I'm seeing an ICMP storm from a mobile phone netblocks belonging to "TELEFONICA MOVILES". Periodically we will get upwards of 5 million in a few seconds, all something like this: 08:12:05.740781 IP ...
0
votes
4answers
20k views

What happens when ARP Request comes from a different subnet?

What will happen when an ARP Request packet is sent from router1 to router2 in the following two cases? Will an ARP Reply be generated or the ARP Request packet be dropped? ...
1
vote
0answers
40 views

Why do nping packets with correct MAC and wrong IP do not reach the other container on the same net?

I have a Docker network with two containers in it. When I run nping with a fake target IP address and a real MAC address of the second container, the packets appear in the tcpdump -eni eth0 output ...
0
votes
1answer
17 views

Reliable UK/EU ICMP Targets for Periodic Routing/Connectivity Tests?

I need to test routing between my United States datacenters and United Kingdom and Mainland Europe ISPs. This is used to distinguish between general transcontinental routing issues and specific ...
3
votes
1answer
326 views

ICMP Redirect Theory VS. Application

I'm trying to watch ICMP redirects in a lab using Cisco Packet Tracer (version 5.3.2) and I'm not seeing them, which leads me to believe that either my lab configuration isn't correct or my ...
0
votes
0answers
65 views

Cannot connect to WebDAV when ICMP (ping) is disabled on a server

I have linux as a Webdav server and Windows 10 as a webdav client. I could successfully connect to the webdav server from Windows using: net use * https://mywebdavserver.com/webdav /USER:user pass ...
1
vote
0answers
48 views

ICMP DDoS, proper ACL?

We are having about a 3-4Gbps ICMP flood on one of our servers and I wonder.. I have a 20gbps of DDoS protection but the proetction seems ineffective against ICMP funnily (it worked well to block a ...
5
votes
1answer
8k views

What exactly do --limit 1/s and --limit-burst mean in iptables rules?

I'm using CentOS 5.x trying to wrap my mind around the following iptables rule on one of my servers: -A RH-Firewall-1-INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT On ...
0
votes
1answer
151 views

Change the order that an IPTABLE CHAIN is read (Using Fail2Ban)

I have some experience using iptables and fail2ban. Both are working as they should, but I would like to optimize the way packets are "DROPed" when IP & port probing occur. Fail2Ban is doing a ...
-1
votes
2answers
94 views

Any protocol used by TRACEROUTE ? ICMP or UDP [closed]

Any protocol used by TRACEROUTE : ICMP or UDP or IP ? Or use them all : Encapsulation ?
4
votes
2answers
1k views

Packets only get forwarded when tcpdump running on bridge

I ran into the oddest thing when trying to debug a networking issue with OpenStack. I was doing a ping test between virtual machines. The ICMP request packets only made it to the destination host if I ...
0
votes
0answers
76 views

ICMP packets in firewalld zones

How are the zones in firewalld configured w.r.t ICMP packets? and do they act differently for interfaces and sources? 1. How firewalld route ICMP packets? I would assume the main zones act as they ...
1
vote
1answer
195 views

centos doesn't reply to icmp request

I have the following situation: Centos7, 2 NIC with following setup: em2(NIC2) : 82.79.24.74/29 82.79.24.75/29 em3(NIC3) : 192.168.0.240/24 192.168.133.240/24 ...
1
vote
1answer
94 views

Debian Linux default interface?

I have a Debian machine with an SNMP pooler running, but I am running into an issue with getting the pooler to use a specific interface. The Debian machine has 3 interfaces allow-hotplug eth0 iface ...
1
vote
2answers
214 views

Why woud ping fail but not traceroute

For a few days now I started making the interesting observation of a machine intermittently not responding to an ICMP ping, while it still responds to an ICMP based traceroute (specifically set via ...
2
votes
3answers
4k views

Test a server using MTR through TCP

Is it possible to use MTR over TCP? If not is there an alternative? I have done some research and I am not finding any way to do such a thing, so I'm wondering if anyone has had any experience with ...
2
votes
0answers
68 views

What should happen when receiving an ICMP Fragmentation Needed message?

In general, and in particular on a Solaris 10 machine ... See, we are having an issue in our network. I handle some reverse proxy instances on a Solaris 10 server that is behind a load balancer, and ...
2
votes
1answer
66 views

Outgoing packet has NATed src address

Configuration/Topology: There are 3 machines hadoop2 | hadoop | driver eth0 10.10.15.3 | eth0 10.10.15.2 | tap0 192.168.0.199 ...
0
votes
0answers
446 views

Timestamp response behaviors in different tools

I was testing out icmp time stamp response on one of my servers using ping and hping3. Here is result of hping3 # hping3 --icmp-ts x.x.x.x HPING x.x.x.x: icmp mode set, 28 headers + 0 data bytes ...
-1
votes
3answers
2k views

Why can i not ping my host behind the firewall. Cisco asa 5505 [closed]

Can anyone please help me to figure out what in my configuration of the Cisco asa 5505 is wrong or missing. I have multiple host behind my firewall these hosts run different websites on port 80. I am ...
0
votes
0answers
258 views

ARP/ICMP in a network environment with overlapping IP address

Currently I have lab network setup to mimic customer's network deployment. (According to the customer, they are using VRF over VLAN so that their customer can have overlapping network connecting to ...
2
votes
2answers
3k views

Block ICMP timestamp & timestamp reply with firewalld

OS: CentOS 7.0 Per the results of a security scan, it has been suggested that we block ICMP timestamp & timestamp reply messages using the firewall (CVE-1999-0524). I've used firewalld to set up ...
0
votes
1answer
45 views

IPv4 ICMP Codes/Errors for WAN transmissions

Can someone tell me which IPv4 ICMP Codes/Errors i have to unlock as Best Practise for WAN transmission (RedHat und Cisco)?
2
votes
2answers
8k views

Why is ICMP categorized as a layer 3 protocol? [closed]

ICMP is categorized as a layer 3 protocol in the OSI model, but as far as i can tell it does not meet the definition of a network layer protocol. It does not provide addressing or packet routing (it ...
0
votes
2answers
1k views

Fastest way to scan all hosts that are online

I am looking to find all the hosts that are online in a set of networks. I would like to find all hosts that are online in the entire network of 170.10.. (there are ~64K possible hosts). The network ...
5
votes
2answers
6k views

Can't ping multihomed Linux machine on non-default interface

I have a multihomed Ubuntu server with a set of interfaces that includes: eth2: 10.10.0.131/24 eth3: 10.20.0.2/24 The default interface is eth2, with a gateway of 10.10.0.1. Here's what the routing ...
0
votes
2answers
1k views

Test for ICMP/TCP timestamp responses and disable responses

We had a penetration test done on our servers and one of the vulnerabilities they suggested we fix is that the host responded to an ICMP timestamp request with TCP timestamp. I've looked around but ...
36
votes
9answers
23k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
1
vote
2answers
10k views

Ping to IP address returned Destination Unreachable for a different IP address… huh?

This was totally an isolated incident, but I performed this command: ping 192.168.1.134 and got this result [image]: Pinging 192.168.1.134 with 32 bytes of data: Reply from 192.168.1.133: ...
3
votes
5answers
3k views

ping https when ICMP is blocked

I working with web servers that ICMP is disabled on them. On the other hand they answer to some https requests. I'm basically looking for http like ping capabilities in order to check if another ...
0
votes
0answers
794 views

Wierd traceroute / ICMP issues on Juniper SRX 210BE

I recently acquired Juniper SRX 210BE; until now I've been using Cisco ASA 5505 but I really want to switch over to Juniper world (big FreeBSD fan and all that). I've got FTTC (fiber to the cabnet) ...
1
vote
2answers
1k views

What would cause alternating “Request timed out.” and “Destination host unreachable.” when using ping command?

I am pinging a Windows 8.1 PC that is currently shut down and I'm getting alternating results "Request timed out." and "Destination host unreachable." What could cause this kind of behavior?
2
votes
5answers
2k views

iptables, ICMP and RELATED

I am using the following simple iptables rule that accepts related packets: -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT I am letting ICMP echo-requests pass with this other rule: ...
2
votes
0answers
60 views

How can I test an ICMP Re-direct message?

I want to test whether my linux machine is actually accepting ICMP re-direct message and updating the entry in routing table.This is what i have done so far to achieve the same. Simulated a ICMP ...