Strange ICMP ping response. Please explain

Eric Boadu · ‎08-15-2008

can you explain the strange ICMP response behavior below????? Thx in advance!

Eric

$ ping 10.200.201.17

PING 10.200.201.17 (10.200.201.17): 56 data bytes

64 bytes from 10.200.201.17: icmp_seq=0 ttl=61 time=31 ms

80 bytes from 10.208.232.60: icmp_type=3 (Dest Unreachable) icmp_code=3

64 bytes from 10.200.201.17: icmp_seq=1 ttl=61 time=15 ms

64 bytes from 10.200.201.17: icmp_seq=2 ttl=61 time=15 ms

36 bytes from 10.208.233.222: icmp_type=3 (Dest Unreachable) icmp_code=3

36 bytes from 10.208.233.191: icmp_type=3 (Dest Unreachable) icmp_code=3

64 bytes from 10.200.201.17: icmp_seq=3 ttl=61 time=15 ms

----10.200.201.17 PING Statistics----

4 packets transmitted, 4 packets received, 0.0% packet loss

round-trip (ms) min/avg/max/med = 15/19/31/15

Giuseppe Larosa · ‎08-15-2008

Hello Eric,

to further investigate what's happening here I would suggest to post the output of traceroute to 10.200.201.17.

I can guess that the intended destination is 3 hops away (icmp reply with TTL=61).

The sending machine the one with the $ prompt (likely a unix or linux device) is sending packets via different paths/gateways.

One path is ok and from there you get answers.

The other path(s) have two next-hops on the path 10.208.233.222 and 10.208.232.60 that :

1) don't know how to reach 10.200.201.17

or

2) have some form of IP filters that deny icmp requests and instead of simply dropping them they send unreachable back

Try to understand what devices are or is 10.208.232.60 and 10.208.233.222

How many NICs have the sending machine ?

Hope to help

Giuseppe

Eric Boadu · ‎08-15-2008

Thank you very much Giuseppe! I'll trace them and let you know.

Thanks,

Eric