topic Unsolicited Echo Reply in Operating System - HP-UX

Unsolicited Echo Reply

Ron Bombard — Wed, 21 May 2003 12:00:50 GMT

I keep receiving the following alerts on my Procurve Switches "ip: icmp: Unsolicited Echo Reply from" and the address its from is a local addresses on my net. Sometimes a pc's address, sometimes a RF scanner or whatnot.

Any idea what causes this, how to stop it, or is it something I should consern myself with? I probably get about 5 of these per day across all my switches.

Thanks for any info.
Ron Bombard, Network Admin.
Native Textiles Inc.

Re: Unsolicited Echo Reply

Paula J Frazer-Campbell — Wed, 21 May 2003 12:13:46 GMT

Hi
This may help:-

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90131/B2355-90131_top.html&con=/hpux/onlinedocs/B2355-90131/00/00/38-con.html&toc=/hpux/onlinedocs/B2355-90131/00/00/38-toc.html&searchterms=echo%7cUnsolicited&queryid=19030521-070836

Also is there one router that all of these devices go through? If so check it out.

Paula

Re: Unsolicited Echo Reply

Ron Kinner — Wed, 21 May 2003 12:36:39 GMT

I'd do a little investigating:

See:

http://www.sans.org/resources/idfaq/traffic.php

Also check out the TFN exploit discussed at:

http://www.sans.org/resources/idfaq/icmp_misuse.php

Ron

Re: Unsolicited Echo Reply

Paula J Frazer-Campbell — Wed, 21 May 2003 12:52:39 GMT

Hi

ip: : icmp: Unsolicited Echo Reply from
An unsolicited ICMP reply to a ping was received from that was not sent by the local switch.

The "not sent by the local switch" may help you.

Paula

Re: Unsolicited Echo Reply

Paula J Frazer-Campbell — Wed, 21 May 2003 12:54:16 GMT

Also check out:-

http://www.iss.net/security_center/advice/Intrusions/2000109/default.htm

Paula

Re: Unsolicited Echo Reply

Paula J Frazer-Campbell — Wed, 21 May 2003 12:56:18 GMT

Also check out:-

http://www.iss.net/security_center/advice/Intrusions/2000109/default.htm

and

Unsolicited echo-replies can be a sign of a Smurf ( http://www.cert.org/advisories/CA-1998-01.html)amplification attack.

Paula

Re: Unsolicited Echo Reply

Paula J Frazer-Campbell — Wed, 21 May 2003 13:00:07 GMT

Ron

Please assign points to your previous questions if the answers have assisted you:-

http://forums.itrc.hp.com/cm/TopSolutions/1,,CA302314!1!questions,00.html

;^)

Paula

Re: Unsolicited Echo Reply

Ron Bombard — Wed, 21 May 2003 14:10:50 GMT

So... it would be your guess that this is some sort of "intrusion" of some kind? If that were the case, wouldn't I see more of these alerts, besides just the few per day?

My firewalls allow ICMP stuff, but limit them to 1 per 60 secs.

Is it recommended to disallow ICMP? According to my firewall docs, I can turn it off and it will:

#drop "bad" icmp -- not replying to
# echo requests but still allowing internal
# pings to work correctly.
# It will accept destination-unreachable,
# time-exceeded, and echo-reply -- and
# drop the rest

Will this cause any forseeable problems?

Re: Unsolicited Echo Reply

Ron Kinner — Wed, 21 May 2003 14:45:09 GMT

I'd turn it off at the firewall. It shouldn't bother anything. Worse case you get a call from your ISP saying his Openview went red and you will have to allow it from him but from what you say it won't stop your unexpected echo replies (if they are really coming from the outside) unless you have a filter which drops all incoming packets with a local source address. (You should have such a filter anyway.)

If you already have such a filter or if after adding one they continue to show up then it could be that for some reason the echo requests are going through a different switch than the replies and that is why they are being flagged. Do your PCs and such have multiple NICs?

Could also be a bug in the code which gives false positives. What kind of switch and what version of code are you running?

Ron

Re: Unsolicited Echo Reply

Ron Bombard — Wed, 21 May 2003 15:04:58 GMT

I don't have any pcs with multiple nics. except for one linux server thats used for a internet proxy and firewall.

As for my switches and firmware: This is happening on multiple switches. They are all HP Procurve switches with the latest firmware (as of last week).

I'll turn off that ICMP at the firewall and see what happens.

Thanks for the suggestions!