Community discussions

 
lunchbox
just joined
Topic Author
Posts: 1
Joined: Tue May 14, 2019 8:39 am

ICMP host unknown - from router to router

Tue May 14, 2019 8:54 am

Hello all,

I was recently reviewing firewall logs and they are filled with this event, which appears to be occurring over 10 times a second.
may/13 22:49:08 firewall,info drop_invalid input: in:(unknown 1) out:(unknown 0), proto ICMP (type 3, code 1), 192.168.100.1->192.168.100.1, len 225 
There was a previous thread created on this - viewtopic.php?t=48098. However, I already checked for scripts and netwatch and that did not help.

Any ideas on what could be causing this?
 
mkx
Forum Guru
Forum Guru
Posts: 2267
Joined: Thu Mar 03, 2016 10:23 pm

Re: ICMP host unknown - from router to router

Tue May 14, 2019 9:21 am

ICMP Type 3 are "Destination Unreachable" class of packets ... Code 1 is "Host Unreachable".

My explanation is that router is informing self that some host is unreachable. As to which host that might be and who is actually trying to access it[*], that's a completely different question. Some more information might be available in the ICMP packet itself, you might access that information by sniffing off those packets and inspecting them in wireshark or similar.

[*] I'd say that the unreachable device is some device which, according to subnet mask, should have been directly accessible by router. If that was not so, the source of incriminated ICM Ppacket would not be this router but some other gateway. The connection initiator, however, might be either router itself, or some device which can not reach target device directly. Either different LAN subnet (if you have more than one) or WAN device trying to access NAT-ed service.
Another possibility is that router can not reach its upstream gateway (which would show in a quite more radical way). Or some device from WAN subnet (if WAN IP is not /32) and some device from your LAN is trying to reach it.
BR,
Metod

Who is online

Users browsing this forum: No registered users and 45 guests