many calls to generate an ICMP error message

[Franky Leeuwerck_1]

Hello everybody,

The output of ' netstat -s ' shows x number of 'calls to generate an ICMP error message' .

Server 1 shows : 367 calls, server 2 shows : 3104 calls.

How should I interprete these figures. Is 367 a low, common and therefore an acceptable number ? Is 3104 a high number of calls that require some kind of intervention ?

Thanks in advance

Franky

[Steve Steel]

Hi

I have 108000 on one of my boxes but this is a very low number compared to what happened in packets on the network.

There are a couple of things which can cause this which are fixed in new patches so check your patch level.

see

http://www.webopedia.com/TERM/I/ICMP.html

Steve Steel

[Ron Kinner · Accepted solution]

Nothing to worry about. The absolute value wouldn't matter anyway. You have to look at it as a percentage of packets in or out.

Netstat -s is a bit stupid when it comes to ICMP error messages. Its idea of an error message is any ICMP reply sent out. On my 11.0 box it says:

66538 calls to generate an ICMP error message

but below that it says:

Output histogram:
echo reply: 29785
destination unreachable: 36753
source quench: 0
routing redirect: 0
echo: 0
time exceeded: 0
parameter problem: 0
time stamp: 0
time stamp reply: 0
address mask request: 0
address mask reply: 0
0 bad ICMP messages

Add the number of echo replies and the number of destination unreachables (plus the rest which are all 0) and you get the number of "icmp error messages"

The echo replies are caused by OpenView pinging us every five minutes to see if we are still alive. The destination unreachable are probably due to someone having a bad route tho there may be other explanations. If these were a significant percentage of my total traffic I might look into it. In my case I have
tcp:
442014900 packets sent

so the percentage is very low and not going to cause any congestion or other problems.

Ron

[Franky Leeuwerck_1]

Thanks for your explanation guys !

Franky