RE: strange icmp packets.

[Chuck Young <cyoung () bbnplanet com>]

Has anyone noticed what the error number was in these packets?  Was it
unreachable? (I think 3).  I have seen ICMP unreachables from hosts not
trying to connect and am wondering what is at the bottom of all this too.

Chuck Young

On Wed, 17 Mar 1999, Frank W. Keeney wrote:

> Date: Wed, 17 Mar 1999 17:12:08 -0800
> From: "Frank W. Keeney" <FKeeney () hsa com>
> To: firewall-wizards () nfr net
> Subject: RE: strange icmp packets.
>
> I've seen lots of these. I'd would be interesting to see their contents
> in a sniffer.
>
>       
>       On Wed, 17 Mar 1999, Darren Reed wrote:
>
>       > Amongst the meabytes of log information that I'm seeing on a
> firewall
>       > are icmp error packets being sent back to hosts which don't
> and have
>       > never existed.  I assume others are seeing the same.  Has
> anyone
>       > looked closer at this and decided it's either replies to
> spoof'd
>       > packets being sent with their address or is someone trying to
> scan
>       > using ICMP error packets ?!  The latter seems somewhat strange
> to me
>       > as you're not meant to reply to those (I'm refering to
> unreachables
>