topic Re: Server constantly sends icmp packets to IP address in Operating System - HP-UX

Server constantly sends icmp packets to IP address

Jason Fedynak — Wed, 27 Sep 2006 12:22:14 GMT

We looked at our firewall logs and saw that one of our HP-UX servers constantly sends icmp packets to IP address 192.168.234.235.

Looked at the syslog.log and there is nothing specific to this address. Where can I start to find out what is causing this?

Re: Server constantly sends icmp packets to IP address

IT_2007 — Wed, 27 Sep 2006 12:49:27 GMT

use traceroute command to find how it queries to that IP.

traceroute 192.168.234.235

Re: Server constantly sends icmp packets to IP address

Jason Fedynak — Wed, 27 Sep 2006 13:51:54 GMT

FYI, we do know the server that is sending the packets (backup server), but how do we find out what app or why it is being sent?

Re: Server constantly sends icmp packets to IP address

Bill Hassell — Wed, 27 Sep 2006 14:02:59 GMT

There's no way to find the program since there is no open socket. Is the 192 address a router? If so, regular pings are done (by default) to monitor router availability. If this is just another server, try grep'ing the address (and also the hostname if applicable) in /etc config files. Check the logs to see if this is a burst then idle or a very regular pattern. A burst means it probably came from a program so look at the time stamps on the ICMP packets to see what what was running at that time. For a regular interval, look at cron jobs.

Re: Server constantly sends icmp packets to IP address

spex — Wed, 27 Sep 2006 14:14:54 GMT

Hi Jason,

# netstat -an | grep '192.168.234.235'
to get the source port(s).

Then,
# grep /etc/services
to see the port alias, if it has one.

Or you can try 'lsof'.

PCS

Re: Server constantly sends icmp packets to IP address

Jason Fedynak — Wed, 27 Sep 2006 14:23:56 GMT

1) the traceroute of the IP takes 2 hops, one through the core router and then to our default gateway to the internet.

2) 192.168.234.235 is not a server/node on our network.

3) netstat -an | grep '192.168.234.235' returns nothing.

I will check the firewall and check if it is bursts or constant.

Re: Server constantly sends icmp packets to IP address

Jason Fedynak — Wed, 27 Sep 2006 14:44:42 GMT

FYI, we get the icmp packet every 60 seconds, 24 hours a day.

Re: Server constantly sends icmp packets to IP address

Jim Keeble — Thu, 28 Sep 2006 07:26:55 GMT

Hi Jason,

It may help to know what kind of icmp packet it is. ICMP has several message types, from the echo and echo replies that ping uses, to messages like "network unreachable" or "port unreachable".

If the firewall log doesn't give this level of detail, get a "nettl" trace and look at the packet details.

The ICMP message could be a diagnostic reaction to a packet the server previously received. If it is, the ICMP packet carries a copy of the packet header that caused the message inside.

You can use "ethereal" (see ethereal.com) to analyze the nettl trace. Or, you could have your network support collect the trace from outside the HP with a "sniffer" (a protocol analyzer).

Re: Server constantly sends icmp packets to IP address

Jason Fedynak — Fri, 29 Sep 2006 17:17:22 GMT

Well I have run a nettl trace on the server and there is quite a bit of info. Of course the network guys are not seeing the dropped packets anymore. I will have to wait untill they show up again. The nettl output looks like what I am looking for though. Thanks!