ICMP stands for Internet Control Message Protocol. It is primarily used by the operating systems of networked computers to send error messages indicating service status.

learn more… | top users | synonyms

0
votes
2answers
30 views

Test for ICMP/TCP timestamp responses and disable responses

We had a penetration test done on our servers and one of the vulnerabilities they suggested we fix is that the host responded to an ICMP timestamp request with TCP timestamp. I've looked around but ...
33
votes
9answers
14k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
1
vote
2answers
9k views

Ping to IP address returned Destination Unreachable for a different IP address… huh?

This was totally an isolated incident, but I performed this command: ping 192.168.1.134 and got this result [image]: Pinging 192.168.1.134 with 32 bytes of data: Reply from 192.168.1.133: ...
2
votes
5answers
2k views

ping https when ICMP is blocked

I working with web servers that ICMP is disabled on them. On the other hand they answer to some https requests. I'm basically looking for http like ping capabilities in order to check if another ...
0
votes
0answers
107 views

Wierd traceroute / ICMP issues on Juniper SRX 210BE

I recently acquired Juniper SRX 210BE; until now I've been using Cisco ASA 5505 but I really want to switch over to Juniper world (big FreeBSD fan and all that). I've got FTTC (fiber to the cabnet) ...
1
vote
2answers
90 views

What would cause alternating “Request timed out.” and “Destination host unreachable.” when using ping command?

I am pinging a Windows 8.1 PC that is currently shut down and I'm getting alternating results "Request timed out." and "Destination host unreachable." What could cause this kind of behavior?
2
votes
5answers
167 views

iptables, ICMP and RELATED

I am using the following simple iptables rule that accepts related packets: -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT I am letting ICMP echo-requests pass with this other rule: ...
0
votes
0answers
123 views

No connectivity between aliased IP networks of different subnet

I am trying to set up two virtual networks(different subnets) to test site to site VPN in my Laptop. My host OS is Debian Wheezy and i am using Virtual box to virtualise my setup. I have two aliased ...
2
votes
0answers
40 views

How can I test an ICMP Re-direct message?

I want to test whether my linux machine is actually accepting ICMP re-direct message and updating the entry in routing table.This is what i have done so far to achieve the same. Simulated a ICMP ...
0
votes
0answers
68 views

What is causing this seemingly excessive ICMP traffic?

This seems to occur when I initiate a connection to an IP that I haven't previously before. Is this a botnet trying to say hi to his friends? As you can see I have an ip filter set in this image, ...
-7
votes
1answer
77 views

Is there a dedicated server that is legal to ping frequently with a massive number of devices? [closed]

I have thousands of devices and all of them need to have some kind of communication pass through them every couple of seconds to stay active. Pinging is sufficient for keeping the devices active. Are ...
1
vote
2answers
196 views

with fully permissive iptables, tcpdump shows icmp echo requests arriving, but no reply's are sent

I'm a bit stumped on where to look next. When using SoftEther IPsec VPN into my network, I can access every server in the main subnet but one. When behind the main firewall, the server responds to all ...
-4
votes
2answers
50 views

How to manage PING replies? [closed]

How can I manage, for example, my Ubuntu mashine so it doesn't (or does) respond to PING(ICMP ECHO_REQUEST - type 8) requests? Normally almost all computers in a LAN network responds to ping with an ...
1
vote
1answer
140 views

Did you see similar icmp ever? [closed]

ping ya.ru PING ya.ru (213.180.193.3) 56(84) bytes of data. 64 bytes from www.yandex.ru (213.180.193.3): icmp_req=1 ttl=60 time=97.6 ms 64 bytes from www.yandex.ru (213.180.193.3): icmp_req=2 ttl=60 ...
1
vote
0answers
215 views

Linux MIPS box: ICMP (ping) works, but TCP does not - how to fix it?

I'm trying to set up MIPS Linux box network. Here is it's configuration: ~ # ifconfig eth0 Link encap:Ethernet HWaddr CC:5D:4E:FF:45:7F inet addr:192.168.0.2 Bcast:192.168.0.255 ...
0
votes
1answer
47 views

Iptables REJECT doesn't let the ftp server list files

I had to comment these 2 lines in my iptables file, because for some reason it was denying ftp listing (it does connect to the ftp server, but it never lists the files and then it just times out): -A ...
2
votes
3answers
215 views

What is the “right way” to monitor network?

My production servers are kept at US east coast and some of the supporting apps are kept at Amsterdam in Europe. There is a Nagios instance running at US east coast as well which does a few port ...
0
votes
2answers
120 views

Caculating packet offset

In Wireshark, if I want to write a filter which accepts only ICMP destination unreachable ( type 3 ) messages, the filter is icmp[0] == 3 . How do I count the packet offset of 0 in this instance ? ...
1
vote
1answer
134 views

Prevent Linux from processing incoming ICMP Host unreachable packets

I have a test setup with one host on a network (10.1.0.0/16) talking via TCP to another one on another network (10.2.0.0/16) and a gateway in the middle. Sometimes, the TCP connection is lost and ...
-2
votes
4answers
9k views

What happens when ARP Request comes from a different subnet?

What will happen when an ARP Request packet is sent from router1 to router2 in the following two cases? Will an ARP Reply be generated or the ARP Request packet be dropped? ...
2
votes
2answers
3k views

Traceroute, ICMP, UDP and TCP

When does traceroute use TCP? Or does it just use UDP, also why does Traceroute use UDP on MacX and ICMP on windows? I thought ICMP just contains a message saying what caused the error of a packet and ...
0
votes
1answer
91 views

How can I proxy ICMP requests?

I have a ubuntu server that receives many ping requests from various other servers in the network. I would like to be able to proxy these requests. Using iptable rules I can see how to DROP or ACCEPT ...
2
votes
4answers
2k views

How to check who blocks ICMP during MTU path negotiation?

I am getting MTU problems with connections to my web host provider. The issue is that I am behind ppoe with MTU size set to 1492 which preventing me from using 'scp'. Once changing MTU from 1492 to ...
0
votes
1answer
442 views

ICMP echo-reply packets with a much lower TTL (-190) than ICMP time-exceeded packets

When I ping the last three hops of a traceroute path to facebook.com from my location, the ICMP echo-reply packets I get back all have a TTL of respectively 58, 57 and 56. The hops in question are the ...
1
vote
2answers
153 views

ICMP and traceroute , How does ICMP keep a counter while it passess hops

When tracerouting a destination and going through all these hops, what happens during this process? Does ICMP have an initial counter and decrements this counter on each hop it passes? If the counter ...
0
votes
2answers
973 views

Test a server using MTR through TCP

Is it possible to use MTR over TCP? If not is there an alternative? I have done some research and I am not finding any way to do such a thing, so I'm wondering if anyone has had any experience with ...
0
votes
0answers
217 views

What does given filed mean in netstat -s on Linux

I am analyzing the the output of netstat -s and wanted to know what "input ICMP message failed" is meant for ,below is output of netstat -s Icmp: 643 ICMP messages received 0 input ICMP ...
5
votes
4answers
2k views

How to stop a ICMP attack?

We are under a heavy icmp flood attack. Tcpdump shows the result below. Altough we have blocked ICMP with iptables tcpdump still prints icmp packets. I've also attached iptables configuration and ...
0
votes
1answer
951 views

ICMP time exceeded in-transit

In the last few days my server suffers an attack of this kind: (bandwith > 60MBit/s, XXX.XXX.XXX.XXX are multiple IPs) tcpdump -n proto ICMP 17:15:19.267464 IP XXX.XXX.XXX.XXX > my_ip: ...
3
votes
3answers
757 views

Reasons to turn off/on unreachables messages?

I see on this question (How can I stop Linux from sending ICMP "Destination Unreachable" responses?) that there was a lot of discussion pointing to the fact that you shouldn't turn off ICMP ...
1
vote
0answers
150 views

Only ICMP traffic allowed inbound on ISA Server 2006

I have recently set up a connection to a remote site. The connection between the sites is done at the ISP level (ie, this is not a B2B tunnel on ISA). I'm fairly lightweight in the networking realm, ...
-4
votes
1answer
524 views

How can I stop Linux from sending ICMP “Destination Unreachable” responses? [closed]

I have a Linux system which has a number of services disabled (for example, telnet). When a telnet client attempts a connection, the system responds with an ICMP "Destination Unreachable". Is there ...
0
votes
2answers
1k views

Is there a good reason for ICMP to be called a layer 3 protocol? [closed]

ICMP is categorized as a layer 3 protocol in the osi model, but as far as i can tell it does not meet the definition of a network layer protocol. It does not provide addressing or packet routing (it ...
4
votes
2answers
2k views

Linux ping command exits early due to ICMP host unreachable

An automated script runs shutdown -r now on a machine, and after a 30s delay, uses ping to determine when the machine is available. I've recently switched the OS from Centos 5 to Oracle Linux 6 and ...
0
votes
2answers
3k views

Fragmentation and packet size,using tcpdump

i am trying to understand concept of fragmentation: i have two virtual machines with public ip connected to a switch. tracepath shows packet not going through gateway from vm1: Trying to send ...
0
votes
1answer
79 views

Why are there two types of ICMP Redirect?

Wikipedia lists 4 types of ICMP Redirect reasons: 0 Redirect for Network 1 Redirect for Host 2 Redirect for Type of Service and Network 3 Redirect for Type of Service and Host I understand ...
0
votes
2answers
548 views

How to properly drop ICMP type 3 packets on possible DDoS attack?

Even after running iptables -A INPUT -p icmp -m icmp --icmp-type 3 -j DROP I keep getting ICMP type 3 code 13 packets on tcpdump. when I run tcpdump icmp, I get messages like: 19:41:31.923630 IP ...
0
votes
0answers
149 views

Multihoming, NAT and ICMP

My router is the default gateway of a LAN and is multihomed. ISP2 is used for HTTP, HTTPS and ISP1, the default gateway of the default routing table, for the rest of the traffic. Similar questions ...
4
votes
1answer
343 views

tcpdump on interface when pinging nonexistent hosts on local network

I've statically configured the IP address of an interface on a server: ip addr add 10.40.0.6/16 broadcast 10.40.255.255 dev eth1 If I try to ping a machine on the network (e.g., 10.40.0.1), it ...
0
votes
2answers
122 views

Restricting ICMP using iptables

I have the following rule,which i believe will restrict icmp packets to 1/s. :INPUT DROP [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [7:988] -A INPUT -i lo -j ACCEPT -A INPUT -p icmp -m icmp ...
2
votes
5answers
407 views

Generating ICMP packets when TTL=2?

By inspecting the payload of ICMP time-exceeded packets, I noticed that sometimes it is the last but one router (when ttl=2 in the returned packet) or even a previous one(up to 5 hops before, ttl=5) ...
4
votes
7answers
1k views

Scan for connected, powered on computers on a network?

I want to scan for powered on computers on my LAN and gather logs about that. I tried nmap but it didn't work very well (a lot of switched on computers are not getting detected). nmap -sP ...
0
votes
0answers
224 views

ICMP ping one way only?

I have 2 W7 hosts (may be others, I haven't checked yet) that are on the network, and can ping the domain controller. They can also ping each other. Yet when I'm on the server, the ping request ...
1
vote
1answer
3k views

pfsense: all interfaces up, but all non default gateways down

I am seeing some strange behavior in pfSense 2.0.3 in which all of my WAN interfaces are up according to the Interfaces screen, yet all but the default gateway are shown as "Offline" in gateway ...
3
votes
2answers
2k views

Can't ping multihoned Linux machine on non-default interface

I have a multihoned Ubuntu server with a set of interfaces that includes: eth2: 10.10.0.131/24 eth3: 10.20.0.2/24 The default interface is eth2, with a gateway of 10.10.0.1. Here's what the routing ...
0
votes
1answer
94 views

Security zones regarding ICMP Flood Attacks

I found this statement describing ICMP Flood attacks and I am confused about the term "Security Zone" being used in it. " Once the ICMP threshold is reached, the server will stop accepting any ...
2
votes
1answer
2k views

What exactly do --limit 1/s and --limit-burst mean in iptables rules?

centos 5.x I'm trying to wrap my mind around the following iptables rule on one of my servers: -A RH-Firewall-1-INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT On another ...
0
votes
2answers
113 views

Multiple ICMP destination unreachable messages

I'm load testing some web services hosted on IIS7. The web services make network calls to underlying services in response to client requests. The client requests are simple HTTP requests but the ...
4
votes
3answers
6k views

Denying ICMP type 3 code 4 traffic - good or bad?

Investigating a slow VPN connection (Cisco ASA IPSec) to a remote office, I noticed on our firewall a lot of access rule matches: Denied ICMP type=3, code=4 from *ip_address* on interface outside I ...
1
vote
1answer
306 views

ICMP rate-limit on time-exceeded messages

How can I set ICMP rate-limiting in a Cisco router? Here on the manual page they only talk about ICMP unreachable messages: ip icmp rate-limit unreachable [df] [ms] [log [packets] [interval-ms]] ...