Port 0 (icmp,eth0,input) 7 packets

wfhoney · 09-02-2003, 02:22 PM

I have a lot of rejected packets going to Port 0, mostly in multiples of 7.

Can anyone explain what these are, or better still, how to set up a rule in ipchains which would allow them to be dropped gracefully (i.e. not hit my default rule which logs)?

Thanks in advance!

----------- snip -------------
Rejected packets from n146-109-141-208.tranquility.net (208.141.109.146).
Port 0 (icmp,eth0,input): 7 packet(s).
Total of 7 packet(s).

Rejected packets from fc-pm6-07.enetis.net (208.141.217.198).
Port 0 (icmp,eth0,input): 7 packet(s).
Total of 7 packet(s).

Rejected packets from s38.pm6.ovis.net (208.140.192.246).
Port 0 (icmp,eth0,input): 7 packet(s).
Total of 7 packet(s).
-------- end snip ----------

m0rl0ck · 09-02-2003, 02:38 PM

Theyre ping (icmp) packets. Could be someone scanning you and using bogus ips, probably the case if youre getting alot of them at the same time.

Put the folowing in a shell script:
----------------------------------------
# Disable response to ping.
/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all

# Disable response to broadcasts.
/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable ICMP redirects.
/bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects

# Log spoofed packets, source routed packets, redirect packets.
echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
---------------------------------------------------------------

And run it. Should take care of it.

wfhoney · 09-02-2003, 03:06 PM

Thanks m0rl0ck!

I had enabled ICMP for the convenience of some users.

markus1982 · 09-02-2003, 04:10 PM

Check the ICMP parameters list (IANA) for more details!