How can I monitor ICMP

slpwkr · 07-23-2006, 11:55 PM

Hi guys how will I monitor the ICMP (pings) to my linux machine? any command?

The netstat command does not display the IP address of the ICMP source.

tgo · 07-23-2006, 11:58 PM

Code:

iptables -I INPUT -p icmp -j LOG --log-level 7 --log-prefix "ping: "

this will log all icmp traffic that comes in on your machine. the logged info will have dest/src ip and icmp type.

Matir · 07-24-2006, 12:05 AM

Be careful, you can get hit by a lot of ICMP traffic in a short period of time, which could lead to an inadvertant DoS of your system with the logging. You may want to use the limit module to reduce the number of log entries.

~=gr3p=~ · 07-24-2006, 04:14 AM

http://linux.maruhn.com/sec/icmpinfo.html