ICMP host unknown - from router to router

RouterOS General
1

Hello all,

I was recently reviewing firewall logs and they are filled with this event, which appears to be occurring over 10 times a second.

may/13 22:49:08 firewall,info drop_invalid input: in:(unknown 1) out:(unknown 0), proto ICMP (type 3, code 1), 192.168.100.1->192.168.100.1, len 225

There was a previous thread created on this - http://forum.mikrotik.com/t/dropped-icmp-packets-from-unknown-interface/43631/1 However, I already checked for scripts and netwatch and that did not help.

Any ideas on what could be causing this?

2

ICMP Type 3 are “Destination Unreachable” class of packets … Code 1 is “Host Unreachable”.

My explanation is that router is informing self that some host is unreachable. As to which host that might be and who is actually trying to access it[*], that’s a completely different question. Some more information might be available in the ICMP packet itself, you might access that information by sniffing off those packets and inspecting them in wireshark or similar.

[*] I’d say that the unreachable device is some device which, according to subnet mask, should have been directly accessible by router. If that was not so, the source of incriminated ICM Ppacket would not be this router but some other gateway. The connection initiator, however, might be either router itself, or some device which can not reach target device directly. Either different LAN subnet (if you have more than one) or WAN device trying to access NAT-ed service.
Another possibility is that router can not reach its upstream gateway (which would show in a quite more radical way). Or some device from WAN subnet (if WAN IP is not /32) and some device from your LAN is trying to reach it.