From: Alex Flex <aflexzor@gmail.com>
To: netfilter@vger.kernel.org
Subject: DROPING ICMP and still getting kernel messages of icmp traffic?
Date: Mon, 08 Apr 2013 12:06:59 -0600 [thread overview]
Message-ID: <51630743.2020404@gmail.com> (raw)
Hello,
I recently got a medium size DoS attack against my uplink, I deduce that
because the attack was bigger than my uplink then I was effectively DoSed.
The attack nature was ICMP, but i had a ruleset to DROP all incomign
ICMP. What confuses me the most is that I saw messages AS IF the kernel
was dealing with ICMP traffic selectively. The result I was expecting
was to not have any type of syslog ICMP messages regarding ICMP because
in theory DROP means DROP silently.
Can anybody explain to me what could have occured?
Feb 27 14:27:11 kernel: Redirect from 125.215.162.43 on eth0 about
125.215.162.46 ignored.
Feb 27 14:27:11 kernel: Advised path = 4.221.27.8 -> 192.168.11.6
Feb 27 14:27:11 kernel: Redirect from 72.15.39.88 on eth0 about
72.15.39.99 ignored.
Feb 27 14:27:11 kernel: Advised path = 4.221.27.8 -> 72.15.39.99
Feb 27 14:27:12 kernel: Redirect from 23.128.38.14 on eth0 about
85.20.63.101 ignored.
Feb 27 14:27:12 kernel: Advised path = 4.221.27.8 -> 85.20.63.101
Feb 27 14:27:13 kernel: Redirect from 89.167.45.143 on eth0 about
89.167.45.118 ignored.
Feb 27 14:27:13 kernel: Advised path = 4.221.27.8 -> 89.167.45.118
Feb 27 14:27:13 kernel: Redirect from 94.255.230.139 on eth0 about
94.255.231.10 ignored.
Feb 27 14:27:14 kernel: Advised path = 4.221.27.8 -> 94.255.231.10
Feb 27 14:27:14 kernel: Redirect from 120.192.115.1 on eth0 about
120.192.115.11 ignored.
Feb 27 14:27:14 kernel: Advised path = 4.221.27.8 -> 120.192.115.11
Feb 27 14:27:15 kernel: Redirect from 183.61.108.1 on eth0 about
183.61.108.112 ignored.
Feb 27 14:27:16 kernel: Advised path = 4.221.27.8 -> 183.61.108.112
Feb 27 14:27:16 kernel: Redirect from 109.164.253.57 on eth0 about
109.164.253.59 ignored.
Feb 27 14:27:16 kernel: Advised path = 4.221.27.8 -> 109.164.253.59
Feb 27 14:27:16 kernel: Redirect from 61.92.213.127 on eth0 about
61.92.212.1 ignored.
Feb 27 14:27:16 kernel: Advised path = 4.221.27.8 -> 119.247.29.11
Finally, is there any difference between DROPing ICMP and using the
sysctl variable to ignore all ICMP?
Alex
next reply other threads:[~2013-04-08 18:06 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-04-08 18:06 Alex Flex [this message]
2013-04-12 23:10 ` DROPING ICMP and still getting kernel messages of icmp traffic? Alex Flex
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=51630743.2020404@gmail.com \
--to=aflexzor@gmail.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox