[clug] Dropped icmp packets - means what?
kim.holburn at anu.edu.au
Fri Aug 22 10:25:36 EST 2003
At 10:07 AM +1000 03/8/22, Peter Barker wrote:
>On Thu, 21 Aug 2003, Felix Karpfen wrote:
>> Attached is a log of the packets that were dropped by "iptables" today.
>Those are "ICMP echo" packets. The "ping" program will cause these to be
>generated. They are basically an "is anyone there" query. And before you
>ask, not answering is a bad idea, if you are there :-)
Not at all. If you are a server or a router answering a ping is usually a good idea otherwise not answering is a good idea generally since there are few good reasons to let most people on the internet know you are there.
> > While the information in "man icmp" is well over my head, it did sound
>> to me that icmp messages relate to kernel activities and ought to be
>> internal to either the computer or - at least - to the network to which
>> the computer is attached.
>icmp is part of the glue which holds everything together. Or, at least,
>tells you when everything is falling apart.
>http://www.faqs.org/docs/iptables/icmptypes.html gives a list of icmp
>> Hence I am puzzled by the IP addresses of many of the dropped packages -
>> I have difficulty in relating these addresses to my ISP (WebOne).
>They're probably just people looking for machines to exploit. Nothing to
>worry about ;-P
>> Since WebOne has figured prominently in recent postings to this list, I
>> thought it worth forwarding my log for <inspection|comment>.
>WebOne are not responsible for this. Try looking up the "source" ip
>pbarker at milligan:~$ host 188.8.131.52
>184.108.40.206.in-addr.arpa domain name pointer
>pbarker at milligan:~$ host 220.127.116.11
>18.104.22.168.in-addr.arpa domain name pointer
>pbarker at milligan:~$ host 22.214.171.124
>126.96.36.199.in-addr.arpa domain name pointer
>pbarker at milligan:~$
>Just make sure your machine is up-to-date. And relax - the internet's a
>nasty place :-)
>> Felix Karpfen
>Peter Barker | N _--_|\ /---- Barham, Vic
>Programmer,Sysadmin,Geek | W + E / /\
>pbarker at barker.dropbear.id.au | S \_,--?_*<-- Canberra
>You need a bigger hammer. | v [35S, 149E]
>"They'll need a whole new Orwellian pseudo-crime-name for that... I
> suggest "digital molestation of kittens". - Jeremi (14640) from Slashdot
Network Consultant - Telecommunications Engineering
Research School of Information Sciences and Engineering
Australian National University - Ph: +61 2 61258620 M: +61 0417820641
Email: kim.holburn at anu.edu.au - PGP Public Key on request
Life is complex - It has real and imaginary parts.
Andrea Leistra (rec.arts.sf.written.Robert-jordan)
More information about the linux