Re: ipf icmp types?

[bAud <baud_(_at_)_videotron_(_dot_)_ca>]

> Erm... I'm not quite common with how ipf logs this stuff, since I
> mainly monitor it with my IDS, but type 8 really is an echo
> request to me... what does /0 mean in this context...? As far as
> I know, an ICMP packet can have only one type...!?


Icmp packets always have 2 fields. The first numeral would indicate the type 
and the second one would indicate the code. A type 8/0 icmp packet is an echo 
request packet. type 0/0 is an echo reply. These logs show some people 
pinging your box. If you had a whole bunch of icmp 0/0 leaving your machine 
without receiving the matching requests first then we could probably assume 
that someone somewhere was sending out spoofed packets with your ip on them. 
However, this isn't the case. Paranoia when paranoia is due. =)

To answer Jay's question the second field is the CODE field. It is used by 
various types of icmp packets to differentiate in return codes. for example 
an icmp packet with a type of 3 is classified as a destination unreachable 
message. 3/0 is returned for network unreachable. 3/1 is returned for 
destination unreachable. type 3 icmp packets have 16 different codes.

The only types of icmp packets that can hold a non-zero code are

type 3 destination unreachable (16 different codes from 0-15)
type 5 redirect (4 different codes from 0-3)
type 11 time exceeded (2 codes  0 or 1)
type 12 parameter problem (2 codes 0 or 1)

Hope this helped

Matt Sauve-Frankel