Ross, Daniel wrote:
yet I am seeing the following:
7/06/2007 12:36:25.343669 bge0 @0:9 b 10.207.109.92 -> 10.207.3.11
PR
icmp len 20 576 icmp timxceed/reassem for 10.207.3.11,2049 -
10.207.109.92,786 PR 17 len 20 1500 IN
the key part is "icmp timxceed/reassem"
http://en.wikipedia.org/wiki/ICMP_Time_Exceeded
"The Time Exceeded Message is an ICMP message which is generated
by a gateway to inform the source of a datagram that the datagram
has been discarded due to the time to live field reaching zero.
A time exceeded message may also be sent by a host if it fails to
reassemble a fragmented datagram within its time limit."
ergo:
either you have a lossy network, a network loop, a routing
misconfiguration, or some similar problem that causes the
symptoms described above.
ps:
why is it so difficult to use a proper subject line on your
post, so that the next guy who encounters a similar problem
can have half a chance of successfully googling this thread
from the ipfilter mailing list archives?
jim
