ICMP stands for Internet Control Message Protocol. It is primarily used by the operating systems of networked computers to send error messages indicating service status.

learn more… | top users | synonyms

11
votes
3answers
23k views

Why do ICMP Redirect Host happen?

I'm setting up a Debian box as a router for 4 subnets. For that I have defined 4 virtual interfaces on the NIC where the LAN is connected (eth1). eth1 Link encap:Ethernet HWaddr ...
-1
votes
1answer
28 views

Manually sent ICMP redirect packets [closed]

I'm trying to sent a ICMP redirect to my router to add a new route, as I can not configure it from the portal, and have no access to it though telnet/ssh. The scenario is the next. LAN network ...
1
vote
2answers
42 views

Do NATs rewrite ipAddress in payload of ICMP packets?

Today when I test running a tracert command (windows + Wireshark) I see a outbound ICMP_ECHO_REQUEST packet that has sourceIP as "192.168.1.55" - my local IPAddress. It is followed by a ...
2
votes
2answers
2k views

Linux is sending ARP requests to hosts in other subnets?

Setup Host B <--> Router <--> Host A Host A: IP = 192.168.1.10, Net = 192.168.1.0/24, VLAN = 1, Default GW = 192.168.1.1 (Router) Host B: IP = 192.168.2.10, Net = 192.168.2.0/24, VLAN ...
0
votes
1answer
35 views

Why are ICMP packets not captured on the target interface?

I have a network setup as in the picture: The central box is a gateway (Ubuntu 15.10) which relays the packets betwen the various networks (only one is shown on the picture - lan0) and Internet. ...
7
votes
1answer
837 views

Forwarding traffic from TUN device (C++ backend) to the default gateway

The following problem is just a piece of the bigger solution I have a problem with. All other elements seem working so far, so I'll try to describe very small piece which I have problem with. I've ...
1
vote
1answer
41 views

Cannot ping through one of the network interfaces

Setup ubuntu linux VM ( virtual-box) is configured with two interfaces, eth0 and eth1. eth0 is on a bridged network and directly connected to external network. eth1 is on "nat network", which is ...
4
votes
7answers
3k views

Scan for connected, powered on computers on a network?

I want to scan for powered on computers on my LAN and gather logs about that. I tried nmap but it didn't work very well (a lot of switched on computers are not getting detected). nmap -sP ...
2
votes
0answers
28 views

TCP Handshake fails when ICMP Redirects are enabled

So it seems that due to ICMP redirects it's not possible to connect to a server behind a VPN connection. It immediately responds with a TCP RST (with manifests itself in SSH as ...
1
vote
0answers
50 views

Sending Ping at fixed packet size as jumbo frame is not working in linux

I have to hosts connected each other with ipv4 address each other. I modified the MTU of each one to 9000. Then I want to send a Ping request at fixed packet size +1500 to verify that can send and ...
-1
votes
1answer
72 views

Default gateway and ARP confusion

I have the following configuration (I'd post a pic but not enough rep for more than 2): PC1 (10.0.2.10/24) and PC2 (10.0.2.137/29) are connected to a hub, which is connected to a router on interface ...
0
votes
1answer
88 views

ICMP - How to send a timestamp and netmask request?

How can I submit a ICMP request for timestamp and netmask request to a host without using NMAP? Is it possible to generate a terminal / command line request with a tool like hping3 or any native ...
3
votes
2answers
143 views

seeing remote MTUs of 250 and 68. is this ever valid?

I'm seeing an ICMP storm from a mobile phone netblocks belonging to "TELEFONICA MOVILES". Periodically we will get upwards of 5 million in a few seconds, all something like this: 08:12:05.740781 IP ...
0
votes
4answers
19k views

What happens when ARP Request comes from a different subnet?

What will happen when an ARP Request packet is sent from router1 to router2 in the following two cases? Will an ARP Reply be generated or the ARP Request packet be dropped? ...
1
vote
0answers
39 views

Why do nping packets with correct MAC and wrong IP do not reach the other container on the same net?

I have a Docker network with two containers in it. When I run nping with a fake target IP address and a real MAC address of the second container, the packets appear in the tcpdump -eni eth0 output ...
0
votes
1answer
16 views

Reliable UK/EU ICMP Targets for Periodic Routing/Connectivity Tests?

I need to test routing between my United States datacenters and United Kingdom and Mainland Europe ISPs. This is used to distinguish between general transcontinental routing issues and specific ...
3
votes
1answer
324 views

ICMP Redirect Theory VS. Application

I'm trying to watch ICMP redirects in a lab using Cisco Packet Tracer (version 5.3.2) and I'm not seeing them, which leads me to believe that either my lab configuration isn't correct or my ...
0
votes
0answers
59 views

Cannot connect to WebDAV when ICMP (ping) is disabled on a server

I have linux as a Webdav server and Windows 10 as a webdav client. I could successfully connect to the webdav server from Windows using: net use * https://mywebdavserver.com/webdav /USER:user pass ...
1
vote
0answers
45 views

ICMP DDoS, proper ACL?

We are having about a 3-4Gbps ICMP flood on one of our servers and I wonder.. I have a 20gbps of DDoS protection but the proetction seems ineffective against ICMP funnily (it worked well to block a ...
5
votes
1answer
8k views

What exactly do --limit 1/s and --limit-burst mean in iptables rules?

I'm using CentOS 5.x trying to wrap my mind around the following iptables rule on one of my servers: -A RH-Firewall-1-INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT On ...
0
votes
1answer
134 views

Change the order that an IPTABLE CHAIN is read (Using Fail2Ban)

I have some experience using iptables and fail2ban. Both are working as they should, but I would like to optimize the way packets are "DROPed" when IP & port probing occur. Fail2Ban is doing a ...
-1
votes
2answers
87 views

Any protocol used by TRACEROUTE ? ICMP or UDP [closed]

Any protocol used by TRACEROUTE : ICMP or UDP or IP ? Or use them all : Encapsulation ?
4
votes
2answers
1k views

Packets only get forwarded when tcpdump running on bridge

I ran into the oddest thing when trying to debug a networking issue with OpenStack. I was doing a ping test between virtual machines. The ICMP request packets only made it to the destination host if I ...
0
votes
1answer
949 views

Linux PCs sending “ICMP udp port unreachable” to DNS server

So digging around in my syslog I have been noticing a lot of ICMP packets being flagged by our ASAs: %ASA-4-313005: No matching connection for ICMP error message: icmp src Internet:x.x.21.122 dst ...
0
votes
0answers
69 views

ICMP packets in firewalld zones

How are the zones in firewalld configured w.r.t ICMP packets? and do they act differently for interfaces and sources? 1. How firewalld route ICMP packets? I would assume the main zones act as they ...
1
vote
1answer
181 views

centos doesn't reply to icmp request

I have the following situation: Centos7, 2 NIC with following setup: em2(NIC2) : 82.79.24.74/29 82.79.24.75/29 em3(NIC3) : 192.168.0.240/24 192.168.133.240/24 ...
1
vote
1answer
91 views

Debian Linux default interface?

I have a Debian machine with an SNMP pooler running, but I am running into an issue with getting the pooler to use a specific interface. The Debian machine has 3 interfaces allow-hotplug eth0 iface ...
0
votes
0answers
109 views

ICMP replies - ingress or egress interface (e.g. from a traceroute)

When a traceroute is initiated and receives an ICMP replies from the nodes, which interface should the be replying from according to RFC 1812. they are actually replying from ingress (where they ...
1
vote
2answers
163 views

Why woud ping fail but not traceroute

For a few days now I started making the interesting observation of a machine intermittently not responding to an ICMP ping, while it still responds to an ICMP based traceroute (specifically set via ...
1
vote
3answers
3k views

Test a server using MTR through TCP

Is it possible to use MTR over TCP? If not is there an alternative? I have done some research and I am not finding any way to do such a thing, so I'm wondering if anyone has had any experience with ...
1
vote
0answers
67 views

What should happen when receiving an ICMP Fragmentation Needed message?

In general, and in particular on a Solaris 10 machine ... See, we are having an issue in our network. I handle some reverse proxy instances on a Solaris 10 server that is behind a load balancer, and ...
2
votes
1answer
65 views

Outgoing packet has NATed src address

Configuration/Topology: There are 3 machines hadoop2 | hadoop | driver eth0 10.10.15.3 | eth0 10.10.15.2 | tap0 192.168.0.199 ...
0
votes
0answers
406 views

Timestamp response behaviors in different tools

I was testing out icmp time stamp response on one of my servers using ping and hping3. Here is result of hping3 # hping3 --icmp-ts x.x.x.x HPING x.x.x.x: icmp mode set, 28 headers + 0 data bytes ...
-1
votes
3answers
2k views

Why can i not ping my host behind the firewall. Cisco asa 5505 [closed]

Can anyone please help me to figure out what in my configuration of the Cisco asa 5505 is wrong or missing. I have multiple host behind my firewall these hosts run different websites on port 80. I am ...
0
votes
0answers
251 views

ARP/ICMP in a network environment with overlapping IP address

Currently I have lab network setup to mimic customer's network deployment. (According to the customer, they are using VRF over VLAN so that their customer can have overlapping network connecting to ...
2
votes
2answers
3k views

Block ICMP timestamp & timestamp reply with firewalld

OS: CentOS 7.0 Per the results of a security scan, it has been suggested that we block ICMP timestamp & timestamp reply messages using the firewall (CVE-1999-0524). I've used firewalld to set up ...
0
votes
1answer
45 views

IPv4 ICMP Codes/Errors for WAN transmissions

Can someone tell me which IPv4 ICMP Codes/Errors i have to unlock as Best Practise for WAN transmission (RedHat und Cisco)?
2
votes
2answers
7k views

Why is ICMP categorized as a layer 3 protocol? [closed]

ICMP is categorized as a layer 3 protocol in the OSI model, but as far as i can tell it does not meet the definition of a network layer protocol. It does not provide addressing or packet routing (it ...
0
votes
2answers
1k views

Fastest way to scan all hosts that are online

I am looking to find all the hosts that are online in a set of networks. I would like to find all hosts that are online in the entire network of 170.10.. (there are ~64K possible hosts). The network ...
5
votes
2answers
6k views

Can't ping multihomed Linux machine on non-default interface

I have a multihomed Ubuntu server with a set of interfaces that includes: eth2: 10.10.0.131/24 eth3: 10.20.0.2/24 The default interface is eth2, with a gateway of 10.10.0.1. Here's what the routing ...
0
votes
2answers
1k views

Test for ICMP/TCP timestamp responses and disable responses

We had a penetration test done on our servers and one of the vulnerabilities they suggested we fix is that the host responded to an ICMP timestamp request with TCP timestamp. I've looked around but ...
36
votes
9answers
23k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
1
vote
2answers
10k views

Ping to IP address returned Destination Unreachable for a different IP address… huh?

This was totally an isolated incident, but I performed this command: ping 192.168.1.134 and got this result [image]: Pinging 192.168.1.134 with 32 bytes of data: Reply from 192.168.1.133: ...
3
votes
5answers
3k views

ping https when ICMP is blocked

I working with web servers that ICMP is disabled on them. On the other hand they answer to some https requests. I'm basically looking for http like ping capabilities in order to check if another ...
0
votes
0answers
768 views

Wierd traceroute / ICMP issues on Juniper SRX 210BE

I recently acquired Juniper SRX 210BE; until now I've been using Cisco ASA 5505 but I really want to switch over to Juniper world (big FreeBSD fan and all that). I've got FTTC (fiber to the cabnet) ...
1
vote
2answers
1k views

What would cause alternating “Request timed out.” and “Destination host unreachable.” when using ping command?

I am pinging a Windows 8.1 PC that is currently shut down and I'm getting alternating results "Request timed out." and "Destination host unreachable." What could cause this kind of behavior?
2
votes
5answers
2k views

iptables, ICMP and RELATED

I am using the following simple iptables rule that accepts related packets: -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT I am letting ICMP echo-requests pass with this other rule: ...
2
votes
0answers
59 views

How can I test an ICMP Re-direct message?

I want to test whether my linux machine is actually accepting ICMP re-direct message and updating the entry in routing table.This is what i have done so far to achieve the same. Simulated a ICMP ...
0
votes
0answers
167 views

What is causing this seemingly excessive ICMP traffic?

This seems to occur when I initiate a connection to an IP that I haven't previously before. Is this a botnet trying to say hi to his friends? As you can see I have an ip filter set in this image, ...
-7
votes
1answer
160 views

Is there a dedicated server that is legal to ping frequently with a massive number of devices? [closed]

I have thousands of devices and all of them need to have some kind of communication pass through them every couple of seconds to stay active. Pinging is sufficient for keeping the devices active. Are ...