Tagged Questions

ICMP stands for Internet Control Message Protocol. It is primarily used by the operating systems of networked computers to send error messages indicating service status.

learn more… | top users | synonyms

0
votes
0answers
58 views

Wierd traceroute / ICMP issues on Juniper SRX 210BE

I recently acquired Juniper SRX 210BE; until now I've been using Cisco ASA 5505 but I really want to switch over to Juniper world (big FreeBSD fan and all that). I've got FTTC (fiber to the cabnet) ...
1
vote
2answers
70 views

What would cause alternating “Request timed out.” and “Destination host unreachable.” when using ping command?

I am pinging a Windows 8.1 PC that is currently shut down and I'm getting alternating results "Request timed out." and "Destination host unreachable." What could cause this kind of behavior?
2
votes
5answers
138 views

iptables, ICMP and RELATED

I am using the following simple iptables rule that accepts related packets: -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT I am letting ICMP echo-requests pass with this other rule: ...
2
votes
0answers
37 views

How can I test an ICMP Re-direct message?

I want to test whether my linux machine is actually accepting ICMP re-direct message and updating the entry in routing table.This is what i have done so far to achieve the same. Simulated a ICMP ...
0
votes
0answers
61 views

What is causing this seemingly excessive ICMP traffic?

This seems to occur when I initiate a connection to an IP that I haven't previously before. Is this a botnet trying to say hi to his friends? As you can see I have an ip filter set in this image, ...
-7
votes
1answer
68 views

Is there a dedicated server that is legal to ping frequently with a massive number of devices? [closed]

I have thousands of devices and all of them need to have some kind of communication pass through them every couple of seconds to stay active. Pinging is sufficient for keeping the devices active. Are ...
1
vote
2answers
165 views

with fully permissive iptables, tcpdump shows icmp echo requests arriving, but no reply's are sent

I'm a bit stumped on where to look next. When using SoftEther IPsec VPN into my network, I can access every server in the main subnet but one. When behind the main firewall, the server responds to all ...
0
votes
0answers
102 views

No connectivity between aliased IP networks of different subnet

I am trying to set up two virtual networks(different subnets) to test site to site VPN in my Laptop. My host OS is Debian Wheezy and i am using Virtual box to virtualise my setup. I have two aliased ...
-4
votes
2answers
49 views

How to manage PING replies? [closed]

How can I manage, for example, my Ubuntu mashine so it doesn't (or does) respond to PING(ICMP ECHO_REQUEST - type 8) requests? Normally almost all computers in a LAN network responds to ping with an ...
1
vote
1answer
134 views

Did you see similar icmp ever? [closed]

ping ya.ru PING ya.ru (213.180.193.3) 56(84) bytes of data. 64 bytes from www.yandex.ru (213.180.193.3): icmp_req=1 ttl=60 time=97.6 ms 64 bytes from www.yandex.ru (213.180.193.3): icmp_req=2 ttl=60 ...
1
vote
0answers
202 views

Linux MIPS box: ICMP (ping) works, but TCP does not - how to fix it?

I'm trying to set up MIPS Linux box network. Here is it's configuration: ~ # ifconfig eth0 Link encap:Ethernet HWaddr CC:5D:4E:FF:45:7F inet addr:192.168.0.2 Bcast:192.168.0.255 ...
0
votes
1answer
43 views

Iptables REJECT doesn't let the ftp server list files

I had to comment these 2 lines in my iptables file, because for some reason it was denying ftp listing (it does connect to the ftp server, but it never lists the files and then it just times out): -A ...
2
votes
3answers
213 views

What is the “right way” to monitor network?

My production servers are kept at US east coast and some of the supporting apps are kept at Amsterdam in Europe. There is a Nagios instance running at US east coast as well which does a few port ...
1
vote
1answer
124 views

Prevent Linux from processing incoming ICMP Host unreachable packets

I have a test setup with one host on a network (10.1.0.0/16) talking via TCP to another one on another network (10.2.0.0/16) and a gateway in the middle. Sometimes, the TCP connection is lost and ...
0
votes
1answer
89 views

How can I proxy ICMP requests?

I have a ubuntu server that receives many ping requests from various other servers in the network. I would like to be able to proxy these requests. Using iptable rules I can see how to DROP or ACCEPT ...
0
votes
1answer
380 views

ICMP echo-reply packets with a much lower TTL (-190) than ICMP time-exceeded packets

When I ping the last three hops of a traceroute path to facebook.com from my location, the ICMP echo-reply packets I get back all have a TTL of respectively 58, 57 and 56. The hops in question are the ...
1
vote
2answers
150 views

ICMP and traceroute , How does ICMP keep a counter while it passess hops

When tracerouting a destination and going through all these hops, what happens during this process? Does ICMP have an initial counter and decrements this counter on each hop it passes? If the counter ...
0
votes
2answers
833 views

Test a server using MTR through TCP

Is it possible to use MTR over TCP? If not is there an alternative? I have done some research and I am not finding any way to do such a thing, so I'm wondering if anyone has had any experience with ...
0
votes
0answers
212 views

What does given filed mean in netstat -s on Linux

I am analyzing the the output of netstat -s and wanted to know what "input ICMP message failed" is meant for ,below is output of netstat -s Icmp: 643 ICMP messages received 0 input ICMP ...
1
vote
0answers
144 views

Only ICMP traffic allowed inbound on ISA Server 2006

I have recently set up a connection to a remote site. The connection between the sites is done at the ISP level (ie, this is not a B2B tunnel on ISA). I'm fairly lightweight in the networking realm, ...
3
votes
3answers
701 views

Reasons to turn off/on unreachables messages?

I see on this question (How can I stop Linux from sending ICMP "Destination Unreachable" responses?) that there was a lot of discussion pointing to the fact that you shouldn't turn off ICMP ...
-4
votes
1answer
503 views

How can I stop Linux from sending ICMP “Destination Unreachable” responses? [closed]

I have a Linux system which has a number of services disabled (for example, telnet). When a telnet client attempts a connection, the system responds with an ICMP "Destination Unreachable". Is there ...
0
votes
2answers
1k views

Is there a good reason for ICMP to be called a layer 3 protocol? [closed]

ICMP is categorized as a layer 3 protocol in the osi model, but as far as i can tell it does not meet the definition of a network layer protocol. It does not provide addressing or packet routing (it ...
0
votes
2answers
3k views

Fragmentation and packet size,using tcpdump

i am trying to understand concept of fragmentation: i have two virtual machines with public ip connected to a switch. tracepath shows packet not going through gateway from vm1: Trying to send ...
0
votes
1answer
77 views

Why are there two types of ICMP Redirect?

Wikipedia lists 4 types of ICMP Redirect reasons: 0 Redirect for Network 1 Redirect for Host 2 Redirect for Type of Service and Network 3 Redirect for Type of Service and Host I understand ...
0
votes
2answers
529 views

How to properly drop ICMP type 3 packets on possible DDoS attack?

Even after running iptables -A INPUT -p icmp -m icmp --icmp-type 3 -j DROP I keep getting ICMP type 3 code 13 packets on tcpdump. when I run tcpdump icmp, I get messages like: 19:41:31.923630 IP ...
4
votes
2answers
2k views

Linux ping command exits early due to ICMP host unreachable

An automated script runs shutdown -r now on a machine, and after a 30s delay, uses ping to determine when the machine is available. I've recently switched the OS from Centos 5 to Oracle Linux 6 and ...
2
votes
2answers
2k views

Traceroute, ICMP, UDP and TCP

When does traceroute use TCP? Or does it just use UDP, also why does Traceroute use UDP on MacX and ICMP on windows? I thought ICMP just contains a message saying what caused the error of a packet and ...
0
votes
1answer
845 views

ICMP time exceeded in-transit

In the last few days my server suffers an attack of this kind: (bandwith > 60MBit/s, XXX.XXX.XXX.XXX are multiple IPs) tcpdump -n proto ICMP 17:15:19.267464 IP XXX.XXX.XXX.XXX > my_ip: ...
0
votes
0answers
145 views

Multihoming, NAT and ICMP

My router is the default gateway of a LAN and is multihomed. ISP2 is used for HTTP, HTTPS and ISP1, the default gateway of the default routing table, for the rest of the traffic. Similar questions ...
4
votes
1answer
318 views

tcpdump on interface when pinging nonexistent hosts on local network

I've statically configured the IP address of an interface on a server: ip addr add 10.40.0.6/16 broadcast 10.40.255.255 dev eth1 If I try to ping a machine on the network (e.g., 10.40.0.1), it ...
0
votes
2answers
121 views

Restricting ICMP using iptables

I have the following rule,which i believe will restrict icmp packets to 1/s. :INPUT DROP [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [7:988] -A INPUT -i lo -j ACCEPT -A INPUT -p icmp -m icmp ...
0
votes
2answers
116 views

Caculating packet offset

In Wireshark, if I want to write a filter which accepts only ICMP destination unreachable ( type 3 ) messages, the filter is icmp[0] == 3 . How do I count the packet offset of 0 in this instance ? ...
0
votes
0answers
220 views

ICMP ping one way only?

I have 2 W7 hosts (may be others, I haven't checked yet) that are on the network, and can ping the domain controller. They can also ping each other. Yet when I'm on the server, the ping request ...
2
votes
5answers
400 views

Generating ICMP packets when TTL=2?

By inspecting the payload of ICMP time-exceeded packets, I noticed that sometimes it is the last but one router (when ttl=2 in the returned packet) or even a previous one(up to 5 hops before, ttl=5) ...
1
vote
1answer
3k views

pfsense: all interfaces up, but all non default gateways down

I am seeing some strange behavior in pfSense 2.0.3 in which all of my WAN interfaces are up according to the Interfaces screen, yet all but the default gateway are shown as "Offline" in gateway ...
3
votes
2answers
2k views

Can't ping multihoned Linux machine on non-default interface

I have a multihoned Ubuntu server with a set of interfaces that includes: eth2: 10.10.0.131/24 eth3: 10.20.0.2/24 The default interface is eth2, with a gateway of 10.10.0.1. Here's what the routing ...
0
votes
1answer
94 views

Security zones regarding ICMP Flood Attacks

I found this statement describing ICMP Flood attacks and I am confused about the term "Security Zone" being used in it. " Once the ICMP threshold is reached, the server will stop accepting any ...
2
votes
1answer
2k views

What exactly do --limit 1/s and --limit-burst mean in iptables rules?

centos 5.x I'm trying to wrap my mind around the following iptables rule on one of my servers: -A RH-Firewall-1-INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT On another ...
0
votes
2answers
110 views

Multiple ICMP destination unreachable messages

I'm load testing some web services hosted on IIS7. The web services make network calls to underlying services in response to client requests. The client requests are simple HTTP requests but the ...
4
votes
7answers
1k views

Scan for connected, powered on computers on a network?

I want to scan for powered on computers on my LAN and gather logs about that. I tried nmap but it didn't work very well (a lot of switched on computers are not getting detected). nmap -sP ...
1
vote
1answer
278 views

ICMP rate-limit on time-exceeded messages

How can I set ICMP rate-limiting in a Cisco router? Here on the manual page they only talk about ICMP unreachable messages: ip icmp rate-limit unreachable [df] [ms] [log [packets] [interval-ms]] ...
1
vote
2answers
119 views

Understanding how Tracert works

From what I gathered so far, Tracert works by sending 3 ICMP echo messages. Starting with a TTL value of 1. For each router the packet encounters, the TTL value will be decremented. For the 1st ...
1
vote
1answer
105 views

Cisco ASA 5500 - Internet connection dies when adding ICMP exception to firewall

When I add ICMP to be allowed both on inside / outside interfaces the internet connection dies. Does anyone know why this happens? I kind of observed that this behavior takes place not just for ICMP. ...
4
votes
1answer
1k views

Nmap ping scan over a VPN tunnel return all hosts alive?

I'm curious as to why running an nmap -sP (ping scan) on a remote subnet linked via a Cisco site-to-site IPSec tunnel returns "host up" status for every IP in the range. [root@xt ~]# nmap -sP ...
2
votes
0answers
214 views

ICMP Redirect Theory VS. Application

I'm trying to watch ICMP redirects in a lab using Cisco Packet Tracer (version 5.3.2) and I'm not seeing them, which leads me to believe that either my lab configuration isn't correct or my ...
3
votes
1answer
84 views

How can I tell if a host is bridged and acting as a router

I would like to scan my DMZ for hosts that are bridged between subnets and have routing enabled. Since I have everything from VMWare servers, to load balancers on the DMZ I'm unsure if every host is ...
1
vote
0answers
125 views

Disable response from outside interface on ASA 5505 while allowing ping (and response from outside) on the inside interface?

On the ASA 5505 How do I allow icmp requests out (and responses back in) while not allowing a response from the outside interface when pinged.
0
votes
1answer
231 views

Ubuntu stops responding to ping from random clients

I got a ubuntu server running redmine from apache. My clients, can access redmine, but stops responding random, and other clients, can browse redmine fine, when the client with the problem cant ...
5
votes
4answers
2k views

How to stop a ICMP attack?

We are under a heavy icmp flood attack. Tcpdump shows the result below. Altough we have blocked ICMP with iptables tcpdump still prints icmp packets. I've also attached iptables configuration and ...