Security Basics mailing list archives
RE: What could this icmp mean?
From: "Andrew Shore" <andrew.shore () holistecs com>
Date: Thu, 24 Feb 2005 22:51:58 -0000
These are ICMP redirect packets. Your default route is not the best to the desired network so the router is telling the client to use a different router. Its to reduce the traffic on the network. HTH -----Original Message----- From: Tomas [mailto:s.tomas () gmail com] Sent: 22 February 2005 13:11 To: security-basics () securityfocus com Subject: What could this icmp mean? Hello list, We have networks (10.30.0.0/24 and 10.30.1.0/24) connected trough VPN and one internet line. The gateways for VPN are 10.30.0.1 from one side and 10.30.1.1 from the other, and 10.30.1.254 for internet (for both networks). I've launched tcpdump today on my internet firewall's internal interface (10.30.1.254) and I found this: 10.30.1.254 > 10.30.1.16: icmp: redirect 10.30.0.4 to host 10.30.1.1 for 10.30.1.16.445 > 10.30.0.4.1959: [|tcp] (DF) (ttl 127, id 7691, bad cksum c76d! differs by 100) (ttl 255, id 23807) I'm a bit confused, what could this icmp mean? First of all, I'm sure that neither of these hosts (10.30.1.254, 10.30.1.16, 10.30.0.4) are sending any icmp requests (I'm not sure about 10.30.1.1; it's not in my control). And the second of all, why the checksum is bad?
Current thread:
- RE: What could this icmp mean? Pablo Moore (Feb 28)
- <Possible follow-ups>
- RE: What could this icmp mean? Andrew Shore (Feb 28)