Re: strange icmp packets.

[Neil Ratzlaff <Neil.Ratzlaff () ucop edu>]

We have been seeing these for many months.  Mostly at a very low level, and
I would not have noticed them at all except that they hit a private subnet
that has never had any machines on it.  They also hit other IP addresses
that do exist.  But when I see  icmp response packets when there was no
query packet, I assume an attempt at a stealth scan.

Neil


Please respond to Darren Reed <avalon () coombs anu edu au>

> To:   firewall-wizards () nfr net
> cc:    (bcc: Bill Royds/HullOttawa/PCH/CA)
> Subject:  strange icmp packets.
>
>
> Amongst the meabytes of log information that I'm seeing on a firewall
> are icmp error packets being sent back to hosts which don't and have
> never existed.  I assume others are seeing the same.  Has anyone
> looked closer at this and decided it's either replies to spoof'd
> packets being sent with their address or is someone trying to scan
> using ICMP error packets ?!  The latter seems somewhat strange to me
> as you're not meant to reply to those (I'm refering to unreachables
> and quenches here).
>
> Darren