Even after running

iptables -A INPUT -p icmp -m icmp --icmp-type 3 -j DROP

I keep getting ICMP type 3 code 13 packets on tcpdump. when I run tcpdump icmp, I get messages like:

19:41:31.923630 IP NAMESOURCE  > MY_NAME: ICMP net IP_SOURCE unreachable, length 76

My question is, How can I get rid of this packets?

Btw, I'm getting this packets from multiple sources, which leads me to think this might be some kind of (D)DoS. But I'm not sure which role I'm playing on this.

Also, snort keeps giving alerts:

[**] [1:485:4] ICMP Destination Unreachable Communication Administratively Prohibited [**]
[Classification: Misc activity] [Priority: 3] 
05/02-19:44:20.171298 SOURCE_IP -> MY_IP
ICMP TTL:238 TOS:0x0 ID:13584 IpLen:20 DgmLen:56
MY_IP:47541 -> SOURCE_IP:8080
TCP TTL:47 TOS:0x0 ID:22750 IpLen:20 DgmLen:60 DF
Seq: 0x5EB7CF7A
  • Before you go on this wild goose chase, make sure your server isn't actually compromised. – Michael Hampton May 3 '13 at 2:09

I'd hazard a guess (hard to be sure without more investigation) that someone is spoofing your IP as a source and you're getting the return traffic.

Remember that tcpdump examines the "wire" (ie, BEFORE iptables) so you'll still see the traffic in tcpdump even if iptables is dropping the traffic.

You can't stop the packets coming to you (your provider needs to do that), all you can do is drop them to minimize the impact on your host.

| improve this answer | |
  • 2
    What I tend to do is to rate limit them. Something like: tldp.org/HOWTO/Adv-Routing-HOWTO/… – Matt May 3 '13 at 0:07
  • I wasn't going to go into the bikeshed of drop or not to drop ICMP. But FWIW, I agree. ICMP exists for a reason and does serve a purpose so it's best to rate-limit rather than flat-out drop them. – fukawi2 May 3 '13 at 0:19

Remember that the iptables rules are processed in the order given, so if the chain returns before it reaches your rule it won't have an effect.

Be careful, ICMP is critical for the working of the 'net, it is used to tell you that some connection worn't work among a long list of other error messages. To swamp any reasonable machine via ICMP would take quite some ingenuity from a miscreant, don't worry too much about this.

| improve this answer | |
  • Thanks for your reply. The iptables chain for input is this dropping all ICMP. There is no accept icmp of any kind on the entire chain. I'm not sure what is happening. I got a report from Amazon, saying that our VPS is port scanning other hosts. So I think, someone is forging ICMP packets with my IP as the source/reply-to. – Diogo Melo May 2 '13 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.