Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 24 Jan 2003 03:56:54 -0800 (PST)
From:      Josh Brooks <user@mail.econolodgetulsa.com>
To:        freebsd-net@freebsd.org
Subject:   catching bad ICMP errors - very odd
Message-ID:  <20030124035318.O64423-100000@mail.econolodgetulsa.com>

next in thread | raw e-mail | index | archive | help

I have inserted this ipfw rule, based on guidance from the archives:

count icmp from any to any icmptype 4,5,9,10,12,13,14,15,16,17,18

Now, I am watching that count rule, and it keeps growing.  This means that
people are sending me packets other than types 0,3,8,11.

So I wanted to see what they were:

tcpdump -vvv -n | grep -v echo | grep -v unreach | grep -v exceeded

and I let that run for hours and hours and hours - and during that time,
the counter continued to grow and grow, but my screen where I was running
tcpdump stayed blank - I never saw a single packet.

So how is it that the counter for the above rule can grow and grow and
grow, but I never see a single ICMP message that says anything besides
"echo", "unreach" or "exceeded" ?

thanks.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030124035318.O64423-100000>