RE: strange icmp packets.

[Neil Ratzlaff <Neil.Ratzlaff () ucop edu>]

I have gotten several icmp codes, most often type 3 (codes 0-3) and type 11,
but  also type 12, 4, and 5.

Neil

At 22:01 03/18/99 +0000, Chuck Young wrote:
> Has anyone noticed what the error number was in these packets?  Was it
> unreachable? (I think 3).  I have seen ICMP unreachables from hosts not
> trying to connect and am wondering what is at the bottom of all this too.
>
> Chuck Young
>
> On Wed, 17 Mar 1999, Frank W. Keeney wrote:
>
> > Date: Wed, 17 Mar 1999 17:12:08 -0800
> > From: "Frank W. Keeney" <FKeeney () hsa com>
> > To: firewall-wizards () nfr net
> > Subject: RE: strange icmp packets.
> >
> > I've seen lots of these. I'd would be interesting to see their contents
> > in a sniffer.
> >
> >      
> >      On Wed, 17 Mar 1999, Darren Reed wrote:
> >
> > > Amongst the meabytes of log information that I'm seeing on a firewall
> > > are icmp error packets being sent back to hosts which don't and have
> > > never existed.  I assume others are seeing the same.  Has anyone
> > > looked closer at this and decided it's either replies to spoof'd
> > > packets being sent with their address or is someone trying to scan
> > > using ICMP error packets ?!  The latter seems somewhat strange to me
> > > as you're not meant to reply to those (I'm refering to unreachables