LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 11-20-2001, 07:31 PM   #1
hommih
Member
 
Registered: Oct 2001
Location: Norway
Distribution: SuSE 7.0, Red Hat 7.2
Posts: 32

Rep: Reputation: 15
Question reverse ICMP


Hi!

Can anyone tell me what the following means:

kernel: IP_MASQ: reverse ICMP: checksum failed from <ip-address>!

Thanks
 
Old 11-22-2001, 02:55 AM   #2
xanthium
Member
 
Registered: Apr 2001
Location: Bombay ( INDIA )
Distribution: RedHat 7.x
Posts: 218

Rep: Reputation: 30
Hi,

Now iam not exactly sure but it could be one of the following :

1.The packets are reverse lookups for hostnames (as in sendmail) and they are rejected because hostnames don't exit.

2. some kind of bogus ICMP flood u should scan for
presence a ddos tool, (which use icmp to talk). So beware someone might be scanning ur network !!!!
This hackers form packets with appropriate checksum's however a novice might not be able to do so and hence ur firewall drops them!


3.Also certain Network games generate this kind of errors .

Check your Log files to ascertain if its not a attack by some script kidie .

Regards ,
Xanthium.
 
Old 11-22-2001, 02:55 AM   #3
xanthium
Member
 
Registered: Apr 2001
Location: Bombay ( INDIA )
Distribution: RedHat 7.x
Posts: 218

Rep: Reputation: 30
Script Kiddie Attack ?

Hi ,

Please dont run to any conclusion until you have scanned your log files carefully.
If you are not sure you can send your log files to SANS .

Regards ,
Xanthium.

Last edited by xanthium; 11-22-2001 at 03:06 AM.
 
Old 11-23-2001, 05:57 AM   #4
raz
Member
 
Registered: Apr 2001
Location: London
Posts: 408

Rep: Reputation: 31
Is the source address of the system logged a Cisco DSL router ?

Anyway the message is caused due to an ICMP packet "unknown type i.e could be a ping request or a route solicitation etc" falling on its Checksum on its return path.

More:
So your system has sent a ICMP type "unknown" to that IP addresses as part of normal network operations.

The checksum when sent out was calculated from a 0, then the destination system reverses the checksum to get a 0 again, however it failed and got some other number flagging it up as corrupted. "this could also be your system flagging the inbound ICMP as corrupted I just don't know from that unhelpful error message"

It shouldn't be anyone trying to DOS you, as all packets would be dropped with a checksum that didn't conform to the RFC, it's more like a system / router messing up somewhere.

/Raz
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
About ICMP Ephracis Linux - Networking 1 11-22-2004 08:01 AM
ICMP traffic archives/writing ICMP traffic in a file maia_1 Programming 0 07-20-2004 03:43 AM
What is ICMP? codedv Linux - Networking 2 01-04-2004 10:12 AM
IP_MASQ:reverse ICMP: failed checksum from quinting Linux - Networking 0 12-05-2001 04:44 PM
Icmp mikeyt_3333 Linux - Security 1 08-09-2001 05:40 AM


All times are GMT -5. The time now is 01:49 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration