Needs SOCK_RAW, no privsep/drop, collecting dust for 21 years and counting.
This is a full-blown setuid root mix of ping and tcpdump:
DESCR
icmpinfo is a tool for observing ICMP messages in a manner similar
to tcpdump(8).
...
README
Vers 1.11.1 - 17 August 95
...
I'll suggest that you leave icmpinfo running all time (with -l, or -lnp for
minimal resource consumption (also see NOTE below)) and recording its
output for further reference.
...
IMPORTANT NOTE : *If* you machine is running a named (is a name
server) you MUST USE -n when leaving icmpinfo unattended, to avoid
some possible looping, when icmpinfo tries to resolve an ip in an
unreachable domain. [this problem of domain generated icmps has been
worked upon... but I found no satisfary solutions, suggestions welcome,
maybe a solution for v1.12 !]
icmpinfo(1)
In normal operation, icmpinfo will only report on "weird" packets, mainly
icmp_unreachable.
Just use ping(8) and tcpdump(8), _especially_ when looking at "weird" packets!
OK to remove?
