Re: strange icmp packets.

[Kaptain <kaptain () kaptain com>]

Sounds like a standard spoofing technique to me.  Take a look at the
following:

ftp://ftp.isi.edu/in-notes/rfc2267.txt



-AK




On Wed, 17 Mar 1999, Darren Reed wrote:

> Amongst the meabytes of log information that I'm seeing on a firewall
> are icmp error packets being sent back to hosts which don't and have
> never existed.  I assume others are seeing the same.  Has anyone
> looked closer at this and decided it's either replies to spoof'd
> packets being sent with their address or is someone trying to scan
> using ICMP error packets ?!  The latter seems somewhat strange to me
> as you're not meant to reply to those (I'm refering to unreachables
> and quenches here).
>
> Darren