0

I noticed that my 10.6.6 box has some process sending out ICMP messages to "random" hosts, which concerns me a lot.

when doing a tcpdump icmp I see a lot of the following

15:41:14.738328 IP macpro > bzq-109-66-184-49.red.bezeqint.net: ICMP macpro udp port websm unreachable, length 36
15:41:15.110381 IP macpro > 99-110-211-191.lightspeed.sntcca.sbcglobal.net: ICMP macpro udp port 54045 unreachable, length 36
15:41:23.458831 IP macpro > 188.122.242.115: ICMP macpro udp port websm unreachable, length 36
15:41:23.638731 IP macpro > 61.85-200-21.bkkb.no: ICMP macpro udp port websm unreachable, length 36
15:41:27.329981 IP macpro > c-98-234-88-192.hsd1.ca.comcast.net: ICMP macpro udp port 54045 unreachable, length 36
15:41:29.349586 IP macpro > c-98-234-88-192.hsd1.ca.comcast.net: ICMP macpro udp port 54045 unreachable, length 36

I got suspicious when my router notified me about a lot of ICMP messages that don't get a response

[INFO] Mon Jan 10 16:31:47 2011 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.1.189 to 212.25.57.90

Does anyone know how to trace which process (or worse kernel module) might be responsible for this?

I rebooted and logged in with a virgin user account and tcpdump showed the same results.

Any dtrace magic welcome.

Improve this question
0

1 Answer 1

Reset to default
0

These are ICMP Destination Unreachable messages. Your examples are all type 3: port unreachable. There are two UDP ports involved: 54045, 9090 (“websm”).

They are normally sent by most IP stacks when another endpoint tries to connect to (or — in the case of UDP — send data to) a port to which no processes is “listening”.

Most likely it is these other IPs that are sending unbidden UDP messages to your machine and the IP stack in your kernel is being “polite” by responding with the equivalent of “Sorry, there nobody here to receive your message.”. It is probably okay that your router is blocking these response messages (maybe a bit on the “paranoid” side, but probably harmless).

Improve this answer
5
  • wouldn't that require my router actually forwarding requests to my mac, so that it in turn would try to respond to the ICMP type 3 requests? My mac is NOT in a DMZ and only receives a select few ports from WAN
    – Jamgold
    Jan 11, 2011 at 1:52
  • Also just found out that port 54045 is being used by skype. Still, when my Mac tried to send out those ICPM type 3 packets, Skype was not running
    – Jamgold
    Jan 11, 2011 at 2:01
  • 2
    Since UDP is stateless, the router is probably just using a simple “N seconds since last activity” timer to decide when to stop forwarding incoming UDP packets. It sounds like some packets came in before the timer expired, but after you rebooted or quit Skype. The router forwarded the packets, your machine sent ICMP unreachable messages, and the router blocked them (due to default “paranoia” or configuration). Still nothing unreasonable here. Keep poking around, you will probably find that, when you ran tcpdump, you had recently quit (or rebooted!) the application that was using port 9090.
    – Chris Johnsen
    Jan 11, 2011 at 2:45
  • thanks a lot for your response. TCP/IP 101 is slowly coming back. I will try if I can quiesce my tcpdump icmp output (btw: my router is in glennbeck mode)
    – Jamgold
    Jan 11, 2011 at 3:24
  • Even after shutting down Skype for 24hours, the "traffic" continued. I finally resorted to ipfw and simply denied all ICMP, that stopped it. Skype still works. I will keep an eye on it.
    – Jamgold
    Jan 13, 2011 at 18:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .