Re: ICMP Destination Unreachable, Administratively Prohibited

From: Anthony Kim <Anthony.Kim(at)VW.COM>
Date: Fri Feb 14 2003 - 11:02:41 EST

On Thu, Feb 13, 2003, Chris Brenton wrote:

> On Thu, 2003-02-13 at 17:35, Neil Dickey wrote:

At first I thought it might be the after-effects of an nmap idle scan actually. That is, instead of RSTs (unfiltered traffic) you are seeing ICMP (3, 13) indicating the traffic to the destination is filtered. But the source port in the original packets do not meet my expectations. So I'm doubtful it was that. If there's a way for nmap to perform an idle scan using randomized source ports off a zombie, then just maybe...

> > I'm getting a "Dest. Unreach." signal from an educational

So true <g>

> > Eight different machines at our site were involved,

Your reasoning (snipped) is sound. And I think I agree.

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Sat Feb 15 00:03:49 2003