[Dshield] ICMP destination unreachable

William Sipila william at osource.com
Thu Nov 1 23:14:49 GMT 2001

hi all,

sorry if this is slightly OT; i'm looking for confirmation on something: i'm
seeing a tremendous surge of "ICMP Destination Unreachable (Network
Unreachable)" messages coming back from a nearby gateway to be received by
our exchange server.  i would hazard a guess that this is our exchange
server trying to send NDR to a nonexistent domain and receiving a response
that it doesn't exist.

does this sound plausible?  the messages are only coming from a single
(very) nearby gateway and only intermittently at a rate of about 0-30/hour.
i haven't been able to compare it with the amount of spam email coming in to
the server, but there has been a bit more than usual (although i never saw
this many ICMP DU messages before)?  anyone seen this before or think this
is something to be worried about?


	- will

    Developer/SysAdmin, OUTSOURCE Consulting Services, Inc. 
    william at osource.com | www.osource.com 

More information about the list mailing list