Re: ICMP_TIME_EXCEEDED to network address?

["E, M" <freehold () EROLS COM>]

I suppose someone could forge fragmented ICMP packets that are missing
some of the fragments and force a host to reply with one of these
packets with an ICMP 11/1.  Is someone at your network doing
traceroute?  You could be seeing a response from a router.

For routine 'what am I seeing?' questions, a good resource is 'What am I
seeing?' :) at

http://www.robertgraham.com/pubs/firewall-seen.html


Missy