From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Derick Anderson" Subject: RE: icmp-host-unreachable as opposed to destination-unreachable Date: Tue, 7 Mar 2006 10:23:15 -0500 Message-ID: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Content-class: urn:content-classes:message List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: bclark , netfilter@lists.netfilter.org =20 > -----Original Message----- > From: netfilter-bounces@lists.netfilter.org=20 > [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of bclark > Sent: Tuesday, March 07, 2006 6:45 AM > To: netfilter@lists.netfilter.org > Subject: icmp-host-unreachable as opposed to destination-unreachable >=20 > Hi all >=20 > Would anyone be kind to explain why would a person reject a=20 > connection to port 113 with icmp-host-unreachable as opposed=20 > to destination-unreachable. > I probally dont understand the difference. > Just something I was wondering. >=20 > Kind Regards > Brent Clark >=20 >From what I can tell, icmp-host-unreachable is a code (1) for the destination-unreachable ICMP type (3). See http://www.spirit.com/Resources/icmp.html for a little more information, and Google RFC 792 for a lot more information. Basically though, "host-unreachable" is more specific than "destination-unreachable". I would think that code 3 would be more appropriate ("port unreachable") to this specific rule but then I don't bother with ident (port 113) rules. There's more information on that on this page: http://grc.com/port_113.htm. Derick Anderson