It's as Joe says... Except I did get one thing wrong in my original message - I forgot to allow for the Ethernet header.
Thus: Data 50 bytes ICMP header 8 bytes IP header 20 bytes Ethernet header 14 bytes Total 92 bytes Thus, the default Whatsup Gold ping size would get caught by the filter size for the nachi/welchia worm. This is something that is being addressed. You'll get the ability to specify what data size you want in the ICMP ping used in monitoring. Workaround (short of removing the filter)? 1) See if you can't set up some sort of ACL that would allow your WhatsUp Gold box to be exluded from the filter. 2) Try monitoring using "Services Only". Mark Symons Ipswitch, Inc Augusta GA -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Brian Boles Sent: Wednesday, October 08, 2003 17:06 To: [EMAIL PROTECTED] Subject: RE: [WhatsUp Forum] ICMP Failure Joe, It is not PINGABLE at the size of 50, but anything 48 or smaller will respond to the PING..... very interesting... -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe Sepielli Sent: Wednesday, October 08, 2003 1:47 PM To: [EMAIL PROTECTED] Subject: Re: [WhatsUp Forum] ICMP Failure Brian, It is possible that the router is blocking ICMP packets of a specific length? To test this theory try this: Tools->Net Tools->Ping. Set the size to 50. If that fails, try other sizes to determine if this is the case. Regards, Joe PS: See the discussion below for details from my associate Mark Symons: The packet size cannot be changed in WhatsUp Gold v8.01. The ICMP packets used by WhatsUp Gold have a data size of 50 bytes, = giving a total packet size of 78 bytes when headers, etc, are factored = in. Now, this is smaller than the 92 bytes that you cite for the = nachi/welchia worm. So your filtering should work in theory. Could you = try and set the cut-off somewhere between (say) 80 and 88? Anyway, I logged a request into our database a couple of days ago for = the WhatsUp Gold ICMP packet size to be reduced to 64 bytes (minimum = Ethernet packet size). I will update the database so that it has your = report as well. Mark Symons Ipswitch, Inc Augusta GA -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Eric Helm Sent: Thursday, September 04, 2003 10:23 To: [EMAIL PROTECTED] Subject: [WhatsUp Forum] Change ICMP packet size Is there any way to change the size of the ICMP packets that are used = for polling devices in WhatsUp Gold 7? I am wanting to implement traffic shaping to drop 92 byte icmp packets = used by the nachi/welchia worm to scan for vulnerable hosts and as soon as I implement this change my whatsup maps show all my devices down. Any help would be great.. Eric Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ In reply to 7 Oct message from [EMAIL PROTECTED]: >This is a multi-part message in MIME format. >------=_NextPart_000_0032_01C38CEE.FE0D5EA0 >Content-Type: text/plain; > charset="us-ascii" >Content-Transfer-Encoding: 7bit >ICMP Failure- > >My WhatsUpGold software is showing it can not ping a router, but >from the actual server, I can ping it just find from the command >line. Anyone ever see this before? > >-bb > > >Brian Boles >Network Administrator >Power Pulse Communications >[EMAIL PROTECTED] >------=_NextPart_000_0032_01C38CEE.FE0D5EA0 >Content-Type: text/html; > charset="us-ascii" >Content-Transfer-Encoding: quoted-printable ><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> ><html xmlns:o=3D"urn:schemas-microsoft-com:office:office" = >xmlns:w=3D"urn:schemas-microsoft-com:office:word" = >xmlns=3D"http://www.w3.org/TR/REC-html40";> ><head> ><META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = >charset=3Dus-ascii"> ><meta name=3DProgId content=3DWord.Document> ><meta name=3DGenerator content=3D"Microsoft Word 10"> <meta >name=3DOriginator content=3D"Microsoft Word 10"> <link >rel=3DFile-List href=3D"cid:[EMAIL PROTECTED]"> ><title>Message</title> ><!--[if gte mso 9]><xml> > <o:OfficeDocumentSettings> > <o:DoNotRelyOnCSS/> > </o:OfficeDocumentSettings> ></xml><![endif]--><!--[if gte mso 9]><xml> > <w:WordDocument> > <w:DocumentKind>DocumentEmail</w:DocumentKind> > <w:EnvelopeVis/> > <w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel> > </w:WordDocument> ></xml><![endif]--> ><style> ><!-- > /* Style Definitions */ > p.MsoNormal, li.MsoNormal, div.MsoNormal > {mso-style-parent:""; > margin:0in; > margin-bottom:.0001pt; > mso-pagination:widow-orphan; > font-size:12.0pt; > font-family:"Times New Roman"; > mso-fareast-font-family:"Times New Roman";} >a:link, span.MsoHyperlink > {color:blue; > text-decoration:underline; > text-underline:single;} >a:visited, span.MsoHyperlinkFollowed > {color:blue; > text-decoration:underline; > text-underline:single;} >p > {mso-margin-top-alt:auto; > margin-right:0in; > mso-margin-bottom-alt:auto; > margin-left:0in; > mso-pagination:widow-orphan; > font-size:12.0pt; > font-family:"Times New Roman"; > mso-fareast-font-family:"Times New Roman";} >span.EmailStyle18 > {mso-style-type:personal-reply; > mso-style-noshow:yes; > mso-ansi-font-size:10.0pt; > mso-bidi-font-size:10.0pt; > font-family:Arial; > mso-ascii-font-family:Arial; > mso-hansi-font-family:Arial; > mso-bidi-font-family:Arial; > color:navy;} >@page Section1 > {size:8.5in 11.0in; > margin:1.0in 1.25in 1.0in 1.25in; > mso-header-margin:.5in; > mso-footer-margin:.5in; > mso-paper-source:0;} >div.Section1 > {page:Section1;} >--> ></style> ><!--[if gte mso 10]> ><style> > /* Style Definitions */=20 > table.MsoNormalTable > {mso-style-name:"Table Normal"; > mso-tstyle-rowband-size:0; > mso-tstyle-colband-size:0; > mso-style-noshow:yes; > mso-style-parent:""; > mso-padding-alt:0in 5.4pt 0in 5.4pt; > mso-para-margin:0in; > mso-para-margin-bottom:.0001pt; > mso-pagination:widow-orphan; > font-size:10.0pt; > font-family:"Times New Roman";} ></style> ><![endif]--> ></head> ><body lang=3DEN-US link=3Dblue vlink=3Dblue >style=3D'tab-interval:.5in'> ><div class=3DSection1> ><blockquote = >style=3D'margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'> ><div> ><p class=3DMsoNormal><font size=3D3 color=3Dnavy face=3D"Times New >= Roman"><span >style=3D'font-size:12.0pt;color:navy'>ICMP = >Failure-<o:p></o:p></span></font></p> ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p > ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'>My WhatsUpGold software is >showing = it can >not ping a router, but from the actual server, I can ping it just >find = from the >command line…<o:p></o:p></span></font></p> ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'>Anyone ever see this = >before?<o:p></o:p></span></font></p> ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p > ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'>-bb<o:p></o:p></span></font></p> ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p > ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p > ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'>Brian = >Boles<o:p></o:p></span></font></p> ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'>Network = >Administrator<o:p></o:p></span></font></p> ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'>Power Pulse = >Communications<o:p></o:p></span></font></p> ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'><a = >href=3D"mailto:[EMAIL PROTECTED]">[EMAIL PROTECTED]</a> ><o:p></o:p></span></font></p> ></div> ></blockquote> ></div> ></body> ></html> >------=_NextPart_000_0032_01C38CEE.FE0D5EA0-- >Please visit http://www.ipswitch.com/support/mailing-lists.html to >be removed from this list. >An Archive of this list is available at: >http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
