Hot answers tagged

17 votes
Accepted

Fastest way to scan all hosts that are online

short answer: nmap -sn -T5 --min-parallelism 100 subnet/mask -oG output.file.txt; grep -v Down output.file.txt explanation: nmap alone should be able to scan much faster. We'll start by limiting nmap ...
user avatar
  • 9,165
17 votes
Accepted

Block ICMP timestamp & timestamp reply with firewalld

firewalld ships with a default set of predefined ICMP types you can use out of the box: # firewall-cmd --get-icmptypes destination-unreachable echo-reply echo-request parameter-problem redirect ...
user avatar
  • 14.8k
9 votes
Accepted

IPv6 - Allow incoming ICMP echo requests

This first bit is not a direct answer to your question. I just include it here for others that don't realise the importance of ICMPv6. IPv6 really needs certain ICMP message types to get through. The ...
user avatar
9 votes

Can't ping EC2 instance after enabling ICMP packets

Allowing ICMP Echo Request as well in the security groups fixed it.
user avatar
8 votes
Accepted

nic: Something Wicked happened! ffff

It appears your Sundance 10/100 NIC is old, perhaps too old... See https://bugzilla.redhat.com/show_bug.cgi?id=748973 (f16 Sundance 10/100 Ethernet module crashes when plugged into gigabit router)
user avatar
  • 1,979
7 votes
Accepted

iptables, ICMP and RELATED

http://www.linuxtopia.org/Linux_Firewall_iptables/x1571.html Another hugely important part of ICMP is the fact that it is used to tell the hosts what happened to specific UDP and TCP connections or ...
user avatar
  • 931
6 votes

What exactly do --limit 1/s and --limit-burst mean in iptables rules?

--limit: Specifies the rate at what tokens get refilled into the bucket. 4/hour means 4 tokens per hour (1 token every 15 minutes). --limit-burst: Specifies the maximum amount of tokens that can be ...
user avatar
5 votes

iptables, ICMP and RELATED

The RELATED rule will take care of the associated ICMP messages by default. From iptables man page, in the section related to conntrack (http://linux.die.net/man/8/iptables): RELATED meaning that ...
user avatar
  • 3,217
5 votes

ICMP - How to send a timestamp and netmask request?

Yes, it's possible using hping3. Here is an example for creating this request for dest IP 10.0.0.19: Timestamp request: sudo hping3 10.0.0.19 --icmp --icmp-ts -V Address mask request: sudo hping3 -C ...
user avatar
  • 408
4 votes

Is there a dedicated server that is legal to ping frequently with a massive number of devices?

I wouldn't be so concerned about legal ramifications here as I would about the server just going away. Use your own server for this, and if at all possible, make sure the devices are pinging a DNS ...
user avatar
  • 108k
4 votes

Test a server using MTR through TCP

MTR supports TCP packet traces when you are using a version that is new enough. Versions 0.85 and 0.86 (current stable builds) support this feature. I know this is an old post, but I figured it ...
user avatar
4 votes

What would cause alternating "Request timed out." and "Destination host unreachable." when using ping command?

I don't know that the details are publicly documented anywhere, but in Windows Vista Microsoft altered the TCP/IP stack to generate "Destination host unreachable" messages when ARP doesn't complete. ...
user avatar
4 votes

icmp ping reply not received by ping process, seen by tcpdump/wireshark

wireshark see the packet before the firewall in reception. that mean a firewall or a similar product filter your reception. (reference) the bad checksum just mean usually that tcp checksum offload is ...
user avatar
  • 16.1k
4 votes
Accepted

Why 224.0.0.1 traffic is filtered by Linux hosts?

I am understanding your question so that you would like to block processing of broadcasts, but not of multicasts, due to possible broadcast security threats. That leads to the question why you ...
user avatar
  • 519
4 votes

ping: Warning: time of day goes back (-203647us), taking countermeasures

This has happened to me on AMD type processors before, where the clocksource wasn't shared between CPUs (it was set to jiffies for me). One of the CPU's was a few jiffies ahead of the other causing ...
user avatar
  • 22.7k
3 votes
Accepted

ping https when ICMP is blocked

You can use psping http://technet.microsoft.com/en-us/sysinternals/jj729731.aspx psping -q -i 0 -n 500 google.com:443
user avatar
  • 46
3 votes
Accepted

Do NATs rewrite ipAddress in payload of ICMP packets?

The answer is that it depends. I have received ICMP messages from systems with a NAT device that let internal IP addresses leak through ICMP messages. However in order for the receiver of an ICMP ...
user avatar
  • 29.7k
3 votes
Accepted

Why would a host block ICMP echo (ping response) yet it allows me to connect to it?

well the main reason to block ICMP is to avoid ping flood attacks Ping flood attack It is performed by sending ICMP request to the host in uncontrolled way so that tcp/ip stack of recievers gets ...
user avatar
3 votes
Accepted

Get remote system time from ICMP timestamp

Read about the protocol and you will find this to be in the format of milliseconds since UT. https://www.ietf.org/rfc/rfc0792.txt Except for when the device can't provide this and the time is bogus - ...
user avatar
3 votes

nic: Something Wicked happened! ffff

Per your ethtool output, I notice enp1s6 is not reporting as supporting auto-negotiation. Is that disabled on the device/port you are connecting too? If possible adjust the device you are connecting ...
user avatar
  • 128k
3 votes
Accepted

understanding a psad error for src 0000:0000:0000:0000:0000:0000:0000:0000

ICMPv6 type 143 is Version 2 Multicast Listener Report as defined in RFC 3810. It is sent from your node to the local router(s) to advertise its ability (or inability) to receive multicast traffic. ...
user avatar
3 votes

icmp_echo_ignore_broadcasts not working for broadcast other than 255

ICMP echoes don't have a source address as a broadcast. The source is the unicast address of the source. The destination will be a the broadcast address.
user avatar
  • 2,139
2 votes

seeing remote MTUs of 250 and 68. is this ever valid?

An MTU of 68 bytes is valid in IPv4 according to RFC 791: Every internet module must be able to forward a datagram of 68 octets without further fragmentation. This is because an internet header may ...
user avatar
  • 29.7k
2 votes

Why not block ICMP?

Nowadays even limiting the ICMP packets in server side can create headache on DDoS attacks. Attacks mostly done by sending huge window ICMP requests to one server and if the server is trying to ...
user avatar
2 votes

ICMP Redirect Theory VS. Application

This is three years old, but browsing old unanswered upvoted questions, so here goes: it's Packet Tracer's fault. I'm extrapolating from How to disable ICMP redirect packets in Cisco IOS? Notes: One ...
user avatar
  • 3,487
2 votes

iptables, ICMP and RELATED

I'll add my own answer to provide my final configuration, inspired by other answers and the following sources: an expired draft by IETF with a useful table which shows which ICMP types allow, deny or ...
user avatar
  • 1,693
2 votes

iptables, ICMP and RELATED

In general is a very bad idea to filter or block icmp, usually the only "valid" bit of icmp to filter is echo-request to "appear" down in a naïve scan. But if you want to explicit allow parts of it ...
user avatar
  • 1,118
2 votes

pfsense: all interfaces up, but all non default gateways down

I have almost the same issue on pfsense ver 2.3.2-RELEASE-p1 After hours of googling I found this. https://forum.pfsense.org/index.php?topic=105644.0 Sometime gateways do not want to response to ping. ...
user avatar
  • 1,481
2 votes

What would cause alternating "Request timed out." and "Destination host unreachable." when using ping command?

Are you pinging a PC on the local network? If you are on the same subnet as the remote device and there is no arp entry, the first 'timed out' is because your PC is trying to arp for the remote device ...
user avatar
  • 907
2 votes

Why woud ping fail but not traceroute

Most probably the pong from ping is blocked/gets discarded, while traceroute uses an error message form a node/hop to determine the route. Traceroute is not a standard tool, in that it uses a trick to ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible