Hi!

Can anyone tell me what the following means:

kernel: IP_MASQ: reverse ICMP: checksum failed from <ip-address>!

Thanks

Hi,

Now iam not exactly sure but it could be one of the following :

1.The packets are reverse lookups for hostnames (as in sendmail) and they are rejected because hostnames don't exit.

2. some kind of bogus ICMP flood u should scan for
presence a ddos tool, (which use icmp to talk). So beware someone might be scanning ur network !!!!
This hackers form packets with appropriate checksum's however a novice might not be able to do so and hence ur firewall drops them!


3.Also certain Network games generate this kind of errors .

Check your Log files to ascertain if its not a attack by some script kidie .

Regards ,
Xanthium.

Hi ,

Please dont run to any conclusion until you have scanned your log files carefully.
If you are not sure you can send your log files to SANS .

Regards ,
Xanthium.

Is the source address of the system logged a Cisco DSL router ?

Anyway the message is caused due to an ICMP packet "unknown type i.e could be a ping request or a route solicitation etc" falling on its Checksum on its return path.

More:
So your system has sent a ICMP type "unknown" to that IP addresses as part of normal network operations.

The checksum when sent out was calculated from a 0, then the destination system reverses the checksum to get a 0 again, however it failed and got some other number flagging it up as corrupted. "this could also be your system flagging the inbound ICMP as corrupted I just don't know from that unhelpful error message"

It shouldn't be anyone trying to DOS you, as all packets would be dropped with a checksum that didn't conform to the RFC, it's more like a system / router messing up somewhere.

/Raz