Th one that sent the ICMP is from the CIP:
Note the offending Datagram is the first sent.
10:39:19.601305 192.168.254.206 > 162.69.28.2: (frag 28485:920@8880) (DF)
(ttl 6
10:39:19.601404 192.168.254.206 > 162.69.28.2: (frag 28485:1480@7400+) (DF)
(ttl
10:39:19.601419 192.168.254.206 > 162.69.28.2: (frag 28485:1480@5920+) (DF)
(ttl
10:39:19.601448 192.168.254.206 > 162.69.28.2: (frag 28485:1480@4440+) (DF)
(ttl
10:39:19.601468 192.168.254.206 > 162.69.28.2: (frag 28485:1480@2960+) (DF)
(ttl
10:39:19.601488 192.168.254.206 > 162.69.28.2: (frag 28485:1480@1480+) (DF)
(ttl
10:39:19.601502 192.168.254.206.1238569367 > 162.69.28.2.2049: 1472 proc-7
(frag
10:39:19.605354 198.140.40.98 > 192.168.254.206: icmp: host 162.69.28.2
unreacha
ble - admin prohibited filter Offending pkt: 192.168.254.206 > 162.69.28.2:
(fra
198.140.40.98 > 192.168.254.206: icmp: host 162.69.28.2 unreachale - admin
prohibited filter Offending pkt: 192.168.254.206 > 162.69.28.2: frag
28485:920@8880) (DF) (ttl 62) (ttl 254
