Flooded with ICMP Unreachable Messages

komodo9 · 09-03-2009, 03:45 PM

Hi,

One of my servers has recently been sending out 400-500 ICMP Unreachable messages per second.

I'm aware these messages are normally sent when a connection is attempted on a closed UDP port, but I'm trying to look into this a bit deeper.

Does anyone know how to log what port these connections are attempting to connect on? I want to make sure it's not an actual port in use (such as bind), that is denying valid connection attempts for some reason. Perhaps some tcpdump or netstat arguments?

Thanks!

Hewson · 09-03-2009, 04:01 PM

The ICMP messages will typically contain the closed port.
You could tcpdump on that server to some pcap, copy it locally then browse the pcap file with wireshark.

komodo9 · 09-03-2009, 04:07 PM

Quote:

Originally Posted by Hewson

The ICMP messages will typically contain the closed port.

That would be great... I'm just not sure how to view the ICMP messages.

Quote:

Originally Posted by Hewson

You could tcpdump on that server to some pcap, copy it locally then browse the pcap file with wireshark.

The problem is this server is extremely high-traffic, so a pcap file would grow massive almost immediately.

Thanks.

Hewson · 09-03-2009, 04:18 PM

Quote:

Originally Posted by komodo9

That would be great... I'm just not sure how to view the ICMP messages.

wireshark; just look at one of the packets, the inner most payload will have what you are looking for.

Quote:

Originally Posted by komodo9

The problem is this server is extremely high-traffic, so a pcap file would grow massive almost immediately.

Thanks.

ya you'd probably want a tcpdump filter.
google knows some good examples; heres one i found: http://acs.lbl.gov/~jason/tcpdump_advanced_filters.txt