Help analyse syslog entry

carboncopy · 12-20-2005, 01:06 AM

I found 7 entry as stated below in my syslog over the period of 12 hours. What is it and is it a security threat?

Code:

Dec DD HH:MM:SS carboncopy kernel: IN=ppp0 OUT=ppp0 SRC=62.34.109.XXX DST=62.34.109.XXX LEN=56 TOS=0x00 PREC=0x00 TTL=45 ID=17060 PROTO=ICMP TYPE=3 CODE=3 [SRC=62.34.109.XXX DST=2XX.XXX.XXX.XXX LEN=330 TOS=0x00 PREC=0x00 TTL=52 ID=61829 PROTO=UDP SPT=15121 DPT=6882 LEN=310 ]

Note, all 7 entry where from the same source IP.

win32sux · 12-20-2005, 02:10 AM

Quote:

Originally Posted by carboncopy

Code:

Dec DD HH:MM:SS carboncopy kernel: IN=ppp0 OUT=ppp0 SRC=62.34.109.XXX DST=62.34.109.XXX LEN=56 TOS=0x00 PREC=0x00 TTL=45 ID=17060 PROTO=ICMP TYPE=3 CODE=3 [SRC=62.34.109.XXX DST=2XX.XXX.XXX.XXX LEN=330 TOS=0x00 PREC=0x00 TTL=52 ID=61829 PROTO=UDP SPT=15121 DPT=6882 LEN=310 ]

just my

:

Quote:

While most people associate the Internet Control Message Protocol (ICMP) with 'ping', ICMP is a key piece of the internet. ICMP is used to report problems back to the sender of a packet; this is what is happening here. Unfortunately, where NAT is involved (including SNAT, DNAT and Masquerade), there are a lot of broken implementations. That is what you are seeing with these messages.

http://www.system-linux.net/doc/shor.../FAQ.htm#faq21

also, to read more about icmp type 3 check this:
http://www.networksorcery.com/enp/pr.../icmp/msg3.htm

carboncopy · 12-20-2005, 02:18 AM

Thanks.

Note to myself, use google.

win32sux · 12-20-2005, 02:25 AM

you're welcome, hehe...

FYI, here's the google searches i used to find your answer:

http://www.google.com/search?&q=icmp+type+3

http://www.google.com/linux?&q=syslo...ype+3+brackets