Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I noticed that my 10.6.6 box has some process sending out ICMP messages to "random" hosts, which concerns me a lot.

when doing a tcpdump icmp I see a lot of the following

15:41:14.738328 IP macpro > bzq-109-66-184-49.red.bezeqint.net: ICMP macpro udp port websm unreachable, length 36
15:41:15.110381 IP macpro > 99-110-211-191.lightspeed.sntcca.sbcglobal.net: ICMP macpro udp port 54045 unreachable, length 36
15:41:23.458831 IP macpro > 188.122.242.115: ICMP macpro udp port websm unreachable, length 36
15:41:23.638731 IP macpro > 61.85-200-21.bkkb.no: ICMP macpro udp port websm unreachable, length 36
15:41:27.329981 IP macpro > c-98-234-88-192.hsd1.ca.comcast.net: ICMP macpro udp port 54045 unreachable, length 36
15:41:29.349586 IP macpro > c-98-234-88-192.hsd1.ca.comcast.net: ICMP macpro udp port 54045 unreachable, length 36

I got suspicious when my router notified me about a lot of ICMP messages that don't get a response

[INFO] Mon Jan 10 16:31:47 2011 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.1.189 to 212.25.57.90

Does anyone know how to trace which process (or worse kernel module) might be responsible for this?

I rebooted and logged in with a virgin user account and tcpdump showed the same results.

Any dtrace magic welcome.

share|improve this question
add comment

migrated from stackoverflow.com Jan 11 '11 at 1:52

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 0 down vote accepted

These are ICMP Destination Unreachable messages. Your examples are all type 3: port unreachable. There are two UDP ports involved: 54045, 9090 (“websm”).

They are normally sent by most IP stacks when another endpoint tries to connect to (or — in the case of UDP — send data to) a port to which no processes is “listening”.

Most likely it is these other IPs that are sending unbidden UDP messages to your machine and the IP stack in your kernel is being “polite” by responding with the equivalent of “Sorry, there nobody here to receive your message.”. It is probably okay that your router is blocking these response messages (maybe a bit on the “paranoid” side, but probably harmless).

share|improve this answer
    
wouldn't that require my router actually forwarding requests to my mac, so that it in turn would try to respond to the ICMP type 3 requests? My mac is NOT in a DMZ and only receives a select few ports from WAN –  Jamgold Jan 11 '11 at 1:52
    
Also just found out that port 54045 is being used by skype. Still, when my Mac tried to send out those ICPM type 3 packets, Skype was not running –  Jamgold Jan 11 '11 at 2:01
2  
Since UDP is stateless, the router is probably just using a simple “N seconds since last activity” timer to decide when to stop forwarding incoming UDP packets. It sounds like some packets came in before the timer expired, but after you rebooted or quit Skype. The router forwarded the packets, your machine sent ICMP unreachable messages, and the router blocked them (due to default “paranoia” or configuration). Still nothing unreasonable here. Keep poking around, you will probably find that, when you ran tcpdump, you had recently quit (or rebooted!) the application that was using port 9090. –  Chris Johnsen Jan 11 '11 at 2:45
    
thanks a lot for your response. TCP/IP 101 is slowly coming back. I will try if I can quiesce my tcpdump icmp output (btw: my router is in glennbeck mode) –  Jamgold Jan 11 '11 at 3:24
    
Even after shutting down Skype for 24hours, the "traffic" continued. I finally resorted to ipfw and simply denied all ICMP, that stopped it. Skype still works. I will keep an eye on it. –  Jamgold Jan 13 '11 at 18:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.