ICMP Destination Unreachable (Host Unreachable) [**] [Solved!!!]

ICMP Destination Unreachable (Host Unreachable) [**] [Solved!!!]

Post by Wouter Jan Wesse » Wed, 20 Feb 2002 02:06:35



Hello to you all.

I had some problems with the IDS alerts in snort regarding the subject
of this post.

 ICMP Destination Unreachable (Host Unreachable) [**]

Well, it seems to be solved here, and I did solve it like this.

1. go to your adsl/router
2. fill in dns properties from your dhcp dns server the correct dns
domain name of your host.
3. save this configuration.

And you are not longer troubled with the ICMP unreachable host
messages.

It is finally a bit quiet in te logs, and also the spp portscan
activities are gone.

Still I am curious how this exactly works, and if my solution helped
some of you, and if it is a correct solution I have applied???

Because maybe I am introducing a security related flaw, what I don't
like ofcourse, because maybe it was alright that the Snort IDS was
generating these alerts.

Well, I hope some of you will send a reply to me with some
backgrounds, and some advice if neccesary.

Just send a copy to my e-mail address if it helped you, or you have
something to say about this post.

Have a nice day you all!

Wouter Jan Wessels.

 
 
 

ICMP Destination Unreachable (Host Unreachable) [**] [Solved!!!]

Post by Karl Heye » Wed, 20 Feb 2002 03:52:21



> I had some problems with the IDS alerts in snort regarding the subject
> of this post.
...
> Because maybe I am introducing a security related flaw, what I don't
> like ofcourse, because maybe it was alright that the Snort IDS was
> generating these alerts.

The ICMP is sent back when you attempt connecting to a another IP and
it cannot get there.  It sounds like you have the correct fix as you
are solving the dsource of the problem.

karl.

 
 
 

ICMP Destination Unreachable (Host Unreachable) [**] [Solved!!!]

Post by Wouter Jan Wesse » Thu, 21 Feb 2002 04:33:22


You are right Karl, somewhat optimistic to send this post.

To be more precise, a lot of repeated ICMP Destination Unreachable
(Host Unreachable) [**]

Where solved, but also a lot are not... I discovered...

So sorry for this.

I am still in search for a good method of not getting an alert from
those ICMP messages, but I would like to log them instead of being
notified.

Do you have a answer for this?

Thanks a lot in advance,

Wouter.



> > I had some problems with the IDS alerts in snort regarding the subject
> > of this post.
>  ...
> > Because maybe I am introducing a security related flaw, what I don't
> > like ofcourse, because maybe it was alright that the Snort IDS was
> > generating these alerts.

> The ICMP is sent back when you attempt connecting to a another IP and
> it cannot get there.  It sounds like you have the correct fix as you
> are solving the dsource of the problem.

> karl.

 
 
 

ICMP Destination Unreachable (Host Unreachable) [**] [Solved!!!]

Post by Karl Heye » Thu, 21 Feb 2002 08:19:51



> You are right Karl, somewhat optimistic to send this post.

> To be more precise, a lot of repeated ICMP Destination Unreachable
> (Host Unreachable) [**]

> Where solved, but also a lot are not... I discovered...

> So sorry for this.

> I am still in search for a good method of not getting an alert from
> those ICMP messages, but I would like to log them instead of being
> notified.

I'm not sure on the application on how to do that, as I've never used
it, but find out more about the packets being sent, type 3 covers alot
of cases (codes) that are not wrong, eg PTMUD but sometimes it can show
some serious error somewhere else.

see if these ICMPs are from the same place or it's going to the same
place and what code the it has.  If you use somethiung like ethereal it
should be fairly easy to find out.

karl.

 
 
 

1. ping-destination host unreachable->solved

Thanks to all of you asisting me on this Problem and giving me useful
hints.
Now THAT WAS TRICKY !

For all off you interested or having a similar problem: here comes the
short version.

The problem:
 2 PCs connected via a hub
 Ping not succesful: "destination host unreachable"

 Tcpdump will show the ping leaving PC1 and PC2 sending an answer.
 But PC1 would never receive the answer.
 Vice versa sending a ping from PC2 to PC1 PC1 would never receive the
packets.

The solution:
 I entered PC1`s BIOS, chose "PNP/PCI CONFIGURATION" and changed "PCI
IRQ Activated By" from "Edge" to "Level"

The hardware:
 Both PCs:
  Linux (SuSE 6.2, RedHat 6.1, Halloween 4 - I tried them all)
  Network-Cards: Netgear FA310  (PCI cards)
 PC1:
  Mainboard: Gigabyte GA-5AX
  ALI-chipset
  AWARD Modular BIOS 4.51PG
 PC2:
  Mainboard: ASUS SP97-V

Driver:
 tulip, Version 0.91g and later tested successfully

 :)
  Thomas

2. Working XF86Config file for Trident 9750 AGP graphic card

3. How to disable ICMP "Destination Unreachable"

4. PGP public key block?

5. Significance of "ICMP Destination Unreachable"

6. Change hostname for Cluster Server

7. ICMP Destination unreachable (Bad port)

8. Any public domain Lycos or Webcrawler type of engine available?

9. Linux ICMP Destination Unreachable Messages not conforming to standards?

10. ICMP destination unreachable - communication filtered

11. ICMP destination unreachable

12. Is it possible, bind has done but the OS still respond with ICMP destination unreachable

13. anybody knows how to disable outbound icmp destination unreachable message