Re: Leaking ICMP and UDP packets

[Antony Stone <Antony@Soft-Solutions.co.uk>]

On Tuesday 20 April 2004 6:13 pm, Daniel David Benson wrote:

> > Are you sure they are un-NATted packets "leaking" through netfilter, and
> > not ICMP packets being sent back to some remote system by the firewall
> > itself, saying "host unreachable" etc?
>
> Finally, after 24 hours I got the following packets on my front edge
> (public) interface:
>
> 09:57:48.388232 10.101.10.103 > 169.254.85.249: icmp: time exceeded
> in-transit 09:58:03.386143 10.101.10.103 > 169.254.85.249: icmp: time
> exceeded in-transit 09:58:18.386973 10.101.10.103 > 169.254.85.249: icmp:
> time exceeded in-transit
>
> * This internal IP isn't any of the 1 to 1 NATs listed below and should
> come out as the global NAT IP.

Correct me if I'm wrong, but isn't 169.254.85.249 one of those Microsoft 
"let's make up a network range if we can't find anyone to talk to" addresses?

In other words, the original packet did not come from the outside world, 
therefore did not come through your firewall (it came from a lonely Windows 
machine inside your network which has decided to create its own IP address, 
and has then decided to send packets to 10.101.10.103, which returned an ICMP 
error through your default gateway), and therefore there was no automatic 
reverse NAT in place to set the source address to what you would expect?

I bet you can't find the original packet, to which this ICMP TTL exceeded 
message corresponds, in your packet sniffer logs, because it never came in 
through the firewall in the first place.

Regards,

Antony.

-- 
This email is intended for the use of the individual addressee(s) named above 
and may contain information that is confidential, privileged or unsuitable 
for overly sensitive persons with low self-esteem, no sense of humour, or 
irrational religious beliefs.

If you have received this email in error, you are required to shred it 
immediately, add some nutmeg, three egg whites and a dessertspoonful of 
caster sugar.   Whisk until soft peaks form, then place in a warm oven for 40 
minutes.   Remove promptly and let stand for 2 hours before adding some 
decorative kiwi fruit and cream.   Then notify me immediately by return email 
and eat the original message.

                                                     Please reply to the list;
                                                           please don't CC me.