Re: ICMP conntrack

[Cedric Blancher <blancher@cartel-securite.fr>]

Le ven 18/10/2002 à 11:52, Antony Stone a écrit :
> Although I agree with what you've said here, it's not really relevant
> to the  original poster's question, because in these cases you'll
> still never see an ICMP entry in the connection tracking table.  
> Because the ICMP packets are RELATED to the original connection, it's
> the original packet which you'll see in the conntrack table - the ICMP
> replies simply get through because of their
> relationship to the original packet.

True ;)

> > So, for ICMP requests, you have some kind of conntrack, based on ICMP
> > sequence number. For ICMP errors, conntrack tries to associate them to
> > an existing entry.
> ICMP sequence number ???   What's that ?

cbr@elendil:~$ ping thor
PING thor (192.168.10.50): 56 data bytes
64 bytes from 192.168.10.50: icmp_seq=0 ttl=255 time=0.3 ms
64 bytes from 192.168.10.50: icmp_seq=1 ttl=255 time=0.3 ms
64 bytes from 192.168.10.50: icmp_seq=2 ttl=255 time=0.2 ms
64 bytes from 192.168.10.50: icmp_seq=3 ttl=255 time=0.3 ms
64 bytes from 192.168.10.50: icmp_seq=4 ttl=255 time=0.3 ms

			     ^^^^^^^^^^
				This

Just spy an ICMP request/reply stuff such as ping with ethereal and look
at sequence number field. It aims to associate received reply to the
good sent request.

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
Consultant en sécurité des systèmes et réseaux  - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE