Filtering on ICMP Packet Types


If you’ve ever attended one of my lectures on TCP/IP communications, then you know that ICMP is one of my favorite protocols. It provides a tremendous amount of information on the health of the network.[7]

Building an ICMP filter is pretty simple since it’s usually one of the many predefined protocol filters. What if you want to filter on a specific type of ICMP packet though? For example, you could build a filter for all ICMP Destination Unreachable packets. These packets indicate that a client may be misconfigured (set up with the wrong DNS server IP address, perhaps) or a service has been unloaded from a system (maybe the DHCP server is down right now).

ICMP packets use two fields to define the type of ICMP message that is being sent - they use a type field and a code field. These fields are adjacent to each other in the packet so we can just simply build one pattern for the specific type/code combination that we are interested in. We can then place our filter at the starting point where these two fields begin.

Figure 29 shows an ICMP packet - I’ve highlighted the type field so you can look at the hex window and see the adjacent code field for the Destination Unreachable - Port Unreachable packet. You can see that the code field follows immediately after type field.

click to expand
Figure 29: The type and code fields are adjacent - this means that we can build a single pattern that includes both field values.

Filtering on the value 0x0303 at protocol offset 14 (in hex) will ensure you catch all the ICMP Port Unreachable messages on the network. Figure 30 shows you what that pattern looks like.

click to expand
Figure 30: This is a great pattern filter -- you don’t even have to use AND/OR operands -- it’s the only pattern you want to match.

The following list indicates all the ICMP type and codes that you can filter on -- remember to combine the type and code fields to build a single pattern for each message. If no code is listed under a specific type number, it means that ICMP type doesn’t have any codes.

#

Type (Code Listed Underneath)

0

Echo Reply

3

Destination Unreachable

  1. Net Unreachable

  2. Host Unreachable

  3. Protocol Unreachable

  4. Port Unreachable

  5. Fragmentation Needed/Don't Fragment Set

  6. Source Route Failed

  7. Destination Network Unknown

  8. Destination Host Unknown

  9. Source Host Isolated

  10. Communication with Destination Network is Administratively Prohibited

  11. Communication with Destination Host is Administratively Prohibited

  12. Destination Network Unreachable for Type of Service

  13. Destination Host Unreachable for Type of Service

  14. Communication Administratively Prohibited

  15. Host Precedence Violation

  16. Precedence cutoff in effect

4

Source Quench

5

Redirect

  1. Redirect Datagram for the Network (or subnet)

  2. Redirect Datagram for the Host

  3. Redirect Datagram for the Type of Service and Network

  4. Redirect Datagram for the Type of Service and Host

6

Alternate Host Address 0 Alternate Address for Host

7

Unassigned

8

Echo

9

Router Advertisement

10

Router Selection

11

Time Exceeded

  1. Time to Live exceeded in Transit

  2. Fragment Reassembly Time Exceeded

12

Parameter Problem

  1. Pointer indicates the error

  2. Missing a Required Option

  3. Bad Length

13

Timestamp

14

Timestamp Reply

15

Information Request

16

Information Reply

17

Address Mask Request

18

Address Mask Reply

Remember -- when you build these filters you need to convert over to hexadecimal if the analyzer vendor wants hex values. These are provided in decimal format.

Note 

For more information on ICMP, refer to RFC 792 and the “Analyzing and Troubleshooting TCP/IP” podbook. -- Laura

[7]Go get a copy of the “Analyzing and Troubleshooting TCP/IP Networks” podbook. There is a lot of information on ICMP and you’ll certainly get other filter ideas based on the troubleshooting issues listed in the book.




Packet Filtering. Catching the Cool Packets.
Packet Filtering: Catching the Cool Packets
ISBN: 1893939383
EAN: 2147483647
Year: 2000
Pages: 65

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net