ICMP Blocking Woes

AFAIK, it's been that way since Win95. I recall a certain
vendor's dodgy ISDN router * * * on Windows traceroute, but
working fine under *ix... for whatever reason, said router didn't
like the ICMP traceroute, but returned unreachables in response
to UDP when TTL expired.

Eddy

Wasn't this based upon the premise that gear should not return ICMP
errors as a result of ICMP packet input as a precaution against error
loops? ie said dodgy router did the _right_ thing?

bdragon@gweep.net wrote:

> AFAIK, it's been that way since Win95. I recall a certain
> vendor's dodgy ISDN router * * * on Windows traceroute, but
> working fine under *ix... for whatever reason, said router didn't
> like the ICMP traceroute, but returned unreachables in response
> to UDP when TTL expired.
>
>
> Eddy

Wasn't this based upon the premise that gear should not return ICMP
errors as a result of ICMP packet input as a precaution against error
loops? ie said dodgy router did the _right_ thing?

That would be disingenious. RFC1122 clearly lists which ICMP are error
messages,

      3.2.2 Internet Control Message Protocol -- ICMP
         ICMP messages are grouped into two classes.

The following from W. Richard Stevens' archive presents some additional
insight:

  <http://www.kohala.com/start/papers.others/vanj.99feb08.txt>

John

John Kristoff wrote:

> > Wasn't this based upon the premise that gear should not return ICMP
> > errors as a result of ICMP packet input as a precaution against error
> > loops? ie said dodgy router did the _right_ thing?

> That would be disingenious. RFC1122 clearly lists which ICMP are error
> messages,

The following from W. Richard Stevens' archive presents some additional
insight:

  <http://www.kohala.com/start/papers.others/vanj.99feb08.txt>

But if you take that quote from RFC792 absolutely literally,

   ...no ICMP messages are sent about ICMP messages.

You shouldn't ever respond to a echo request with an echo reply, or
timestamp requests/responses, or netmask request/responses, etc.