RE: [WhatsUp Forum] ICMP Failure

Aaron_Brooks Wed, 08 Oct 2003 18:55:01 -0700

Actually, i've seen this a couple of times. Alot of companies are now restricting ICMP packet sizes to help against DoS attacks. It kinda makes sense if you limit the size, you reduce the bandwidth being used.

"Brian Boles" <[EMAIL PROTECTED]>
Sent by: [EMAIL PROTECTED]

10/08/03 05:06 PM

Please respond to
[EMAIL PROTECTED]

To	<[EMAIL PROTECTED]>
cc
Subject	RE: [WhatsUp Forum] ICMP Failure

Joe, It is not PINGABLE at the size of 50, but anything 48 or smaller will respond to the PING..... very interesting... -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe Sepielli Sent: Wednesday, October 08, 2003 1:47 PM To: [EMAIL PROTECTED] Subject: Re: [WhatsUp Forum] ICMP Failure Brian, It is possible that the router is blocking ICMP packets of a specific length? To test this theory try this: Tools->Net Tools->Ping. Set the size to 50. If that fails, try other sizes to determine if this is the case. Regards, Joe PS: See the discussion below for details from my associate Mark Symons: The packet size cannot be changed in WhatsUp Gold v8.01. The ICMP packets used by WhatsUp Gold have a data size of 50 bytes, = giving a total packet size of 78 bytes when headers, etc, are factored = in. Now, this is smaller than the 92 bytes that you cite for the = nachi/welchia worm. So your filtering should work in theory. Could you = try and set the cut-off somewhere between (say) 80 and 88? Anyway, I logged a request into our database a couple of days ago for =""> the WhatsUp Gold ICMP packet size to be reduced to 64 bytes (minimum = Ethernet packet size). I will update the database so that it has your = report as well. Mark Symons Ipswitch, Inc Augusta GA -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Eric Helm Sent: Thursday, September 04, 2003 10:23 To: [EMAIL PROTECTED] Subject: [WhatsUp Forum] Change ICMP packet size Is there any way to change the size of the ICMP packets that are used = for polling devices in WhatsUp Gold 7? I am wanting to implement traffic shaping to drop 92 byte icmp packets = used by the nachi/welchia worm to scan for vulnerable hosts and as soon as I implement this change my whatsup maps show all my devices down. Any help would be great.. Eric Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ In reply to 7 Oct message from [EMAIL PROTECTED]: >This is a multi-part message in MIME format. >------=_NextPart_000_0032_01C38CEE.FE0D5EA0 >Content-Type: text/plain; > charset="us-ascii" >Content-Transfer-Encoding: 7bit >ICMP Failure- > >My WhatsUpGold software is showing it can not ping a router, but >from the actual server, I can ping it just find from the command >line. Anyone ever see this before? > >-bb > > >Brian Boles >Network Administrator >Power Pulse Communications >[EMAIL PROTECTED] >------=_NextPart_000_0032_01C38CEE.FE0D5EA0 >Content-Type: text/html; > charset="us-ascii" >Content-Transfer-Encoding: quoted-printable ><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> ><html xmlns:o=3D"urn:schemas-microsoft-com:office:office" = >xmlns:w=3D"urn:schemas-microsoft-com:office:word" = >xmlns=3D"http://www.w3.org/TR/REC-html40"> ><head> ><META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = >charset=3Dus-ascii"> ><meta name=3DProgId content=3DWord.Document> ><meta name=3DGenerator content=3D"Microsoft Word 10"> <meta >name=3DOriginator content=3D"Microsoft Word 10"> <link >rel=3DFile-List href="" PROTECTED]"> ><title>Message</title> > ></style> > ></head> ><body lang=3DEN-US link=3Dblue vlink=3Dblue >style=3D'tab-interval:.5in'> ><div class=3DSection1> ><blockquote = >style=3D'margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'> ><div> >= Roman">style=3D'font-size:12.0pt;color:navy'>ICMP = >Failure-<o:p></o:p> >face=3DArial>10.0pt;font-family:Arial;color:navy'><o:p> </o:p> >face=3DArial>10.0pt;font-family:Arial;color:navy'>My WhatsUpGold software is >showing = it can >not ping a router, but from the actual server, I can ping it just >find = from the >command line…<o:p></o:p> >face=3DArial>10.0pt;font-family:Arial;color:navy'>Anyone ever see this = >before?<o:p></o:p> >face=3DArial>10.0pt;font-family:Arial;color:navy'><o:p> </o:p> >face=3DArial>10.0pt;font-family:Arial;color:navy'>-bb<o:p></o:p> >face=3DArial>10.0pt;font-family:Arial;color:navy'><o:p> </o:p> >face=3DArial>10.0pt;font-family:Arial;color:navy'><o:p> </o:p> >face=3DArial>10.0pt;font-family:Arial;color:navy'>Brian = >Boles<o:p></o:p> >face=3DArial>10.0pt;font-family:Arial;color:navy'>Network = >Administrator<o:p></o:p> >face=3DArial>10.0pt;font-family:Arial;color:navy'>Power Pulse = >Communications<o:p></o:p> >face=3DArial>10.0pt;font-family:Arial;color:navy'><a = >href="" PROTECTED]">[EMAIL PROTECTED]</a> ><o:p></o:p> ></div> ></blockquote> ></div> ></body> ></html> >------=_NextPart_000_0032_01C38CEE.FE0D5EA0-- >Please visit http://www.ipswitch.com/support/mailing-lists.html to >be removed from this list. >An Archive of this list is available at: >http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/

RE: [WhatsUp Forum] ICMP Failure

Reply via email to