ICMP Type 3 error messages from PIX 501

[Kevin Melton]

when I turn on "debug icmp trace" on my PIX 501, I see a contiguous stream of the following:

210: ICMP unreachable (code 3) kevin7 > 192.168.69.1

211: ICMP unreachable (code 3) kevin7 > 192.168.69.1

212: ICMP unreachable (code 3) kevin7 > 192.168.69.1

213: ICMP unreachable (code 3) kevin7 > 192.168.69.1

214: ICMP unreachable (code 3) kevin7 > 192.168.69.1

215: ICMP unreachable (code 3) kevin7 > 192.168.69.1

216: ICMP unreachable (code 3) kevin7 > 192.168.69.1

217: ICMP unreachable (code 3) kevin7 > 192.168.69.1

218: ICMP unreachable (code 3) kevin7 > 192.168.69.1

219: ICMP unreachable (code 3) kevin7 > 192.168.69.1

220: ICMP unreachable (code 3) kevin7 > 192.168.69.1

221: ICMP unreachable (code 3) kevin7 > 192.168.69.1

222: ICMP unreachable (code 3) kevin7 > 192.168.69.1

223: ICMP unreachable (code 3) kevin7 > 192.168.69.1

224: ICMP unreachable (code 3) kevin7 > 192.168.69.1

Understand that the address 192.168.69.1 is the inside address of the PIX itself. Kevin7 is a workstation in the same 192.68.69 network... his address is .120.

What does this mean?

thx

[Fernando_Meza]

Can you please post the outpuf of show run | inc icmp

It looks like the kevin7 is trying to ping your PIX and the PIX might not have icmp enabled on the inside interface

[Kevin Melton]

Yes here is the output of the "sho run | inc icmp" as requested:

kmnrfw1# sho run | inc icmp

access-list outside_in permit icmp any any echo-reply

access-list outside_in permit icmp any any source-quench

access-list outside_in permit icmp any any unreachable

access-list outside_in permit icmp any any time-exceeded

kmnrfw1#

I am not sure why the box called Kevin7 would be continously pinging the Gateway like that??

Thanks

[bthibode]

I saw this a couple of days ago on a client's network. The client's CSC module failed on his ASA and during the troubleshooting process, I discovered this was happening. I am at a loss as to explain why this is happening. This is not a false report by the PIX/ASA in my opinion, cos when we unplugged the PC, the icmp messages stop. I do find it strange that only icmp unreachable messages are flooding the interface. Could this be some sort of an attack? Has anyone else ever seen this behavior before?

Bryan