7-22
MAX Administration Guide
Administering TCP/IP
Managing the Internet Control Message Protocol (ICMP)
During the Ping exchange, the MAX displays information about the packet exchange,
including the Time-To-Live (TTL) of each ICMP echo-response packet.
Note:
The maximum TTL for ICMP Ping is 255, and the maximum TTL for TCP is often 60
or lower, so you might be able to Ping a host but be unable to run a TCP application (such as
Telnet or FTP) to it. If you Ping a host running an earlier version of Berkeley UNIX than
4.3BSD-Tahoe, the TTL report is 255 minus the number of routers in the round-trip path. If
you Ping a host running the current version of Berkeley UNIX, the TTL report is 255 minus
the number of routers in the path from the remote system to the station performing the Ping.
Displaying ICMP information
Display ICMP-related information by using the Show ICMP command. Use the command to
see the packets that have been received by the unit and how many of those have been received
with errors. For example:
ascend% show icmp ?
2539 packets received.
0 packets received with errors.
Input histogram:
992 destination unreachable.
1512 redirect.
11 echo requests.
24 time exceeded.
11 packets transmitted.
0 packets not transmitted due to lack of resources.
Output histogram:
11 echo replies.
In the preceding example, there are 1512 redirect packets. A redirect packet instructs the
receiver of the packet to override a setting in its routing table. There were also 11 Echo
Requests and 11 Echo Replies. An Echo Request is a signal that determines whether a node can
receive and acknowledge data transmissions. A host sends an Echo Request packet, and if the
destination is properly connected and receives the request packet, it sends back an Echo Reply
packet. A router can use an ICMP Redirect packet to tell a host that it is sending packets to the
wrong router and to inform the host of the correct route.
Preventing ICMP security breaches
A forged ICMP Redirect packet can alter the host’s routing table and compromise the security
of the network. For this reason, many firewall builders prohibit ICMP traffic from their
networks.
A Denial of Service (DoS) attack also uses ICMP echo request packets to deliberately interfere
with network performance. Under ordinary circumstances, to determine whether a machine on
the Internet is connected and responding, a host sends an ICMP Echo Request packet. If a
machine receives the packet, it returns an ICMP Echo Reply packet. In a DoS attack, however,
an attacker directs ICMP Echo Request packets to IP broadcast addresses from one or more
remote locations. An intermediary receives an ICMP Echo Request packet directed to the IP
broadcast address of its network. If the intermediary does not filter the ICMP traffic, the
machines on the network receive request and send a reply. The reply packets do not use the IP
address of the source machine as the source address. Instead, they contain the spoofed source