HP 6125G HP 6125G & 6125G/XG Blade Switches Layer 3 - IP Services Conf - Page 82

Disadvantages of sending ICMP error packets, Configuration procedure

Get HP 6125G PDF manuals and user guides View all HP 6125G manuals
Add to My Manuals
Save this manual to your list of manuals

Page 82 highlights

If the device receives an IP packet with the destination unreachable, it will drop the packet and send an ICMP destination unreachable error packet to the source. Conditions for sending an ICMP destination unreachable packet: { If neither a route nor the default route for forwarding a packet is available, the device will send a "network unreachable" ICMP error packet. { If the destination of a packet is local but the transport layer protocol of the packet is not supported by the local device, the device sends a "protocol unreachable" ICMP error packet to the source. { When receiving a packet with the destination being local and transport layer protocol being UDP, if the packet's port number does not match the running process, the device will send the source a "port unreachable" ICMP error packet. { If the source uses "strict source routing" to send packets, but the intermediate device finds that the next hop specified by the source is not directly connected, the device will send the source a "source routing failure" ICMP error packet. { When forwarding a packet, if the MTU of the sending interface is smaller than the packet, but the packet has been set as "Don't Fragment," the device will send the source a "fragmentation needed and Don't Fragment (DF)-set" ICMP error packet. Disadvantages of sending ICMP error packets Sending ICMP error packets facilitates network control and management, but it has the following disadvantages: • Increases network traffic. • A device's performance degrades if it receives a lot of malicious packets that cause it to respond with ICMP error packets. • A host's performance degrades if the redirection function increases the size of its routing table. • End users are affected because of receiving ICMP destination unreachable packets caused by malicious users. To prevent such problems, disable the device from sending ICMP error packets. Configuration procedure The device stops sending "TTL timeout" ICMP error packets after sending ICMP timeout packets is disabled. However, "reassembly timeout" error packets will be sent normally. To enable sending of ICMP error packets: Step 1. Enter system view. 2. Enable sending of ICMP redirect packets. 3. Enable sending of ICMP timeout packets. 4. Enable sending of ICMP destination unreachable packets. Command system-view ip redirects enable ip ttl-expires enable ip unreachables enable Remarks N/A Disabled by default Disabled by default Disabled by default 74

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
74
If the device receives an IP packet with the destination unreachable, it will drop the packet and
send an ICMP destination unreachable error packet to the source.
Conditions for sending an ICMP destination unreachable packet:
{
If neither a route nor the default route for forwarding a packet is available, the device will send
a "network unreachable" ICMP error packet.
{
If the destination of a packet is local but the transport layer protocol of the packet is not
supported by the local device, the device sends a "protocol unreachable" ICMP error packet to
the source.
{
When receiving a packet with the destination being local and transport layer protocol being
UDP, if the packet’s port number does not match the running process, the device will send the
source a "port unreachable" ICMP error packet.
{
If the source uses "strict source routing" to send packets, but the intermediate device finds that
the next hop specified by the source is not directly connected, the device will send the source
a "source routing failure" ICMP error packet.
{
When forwarding a packet, if the MTU of the sending interface is smaller than the packet, but
the packet has been set as "Don’t Fragment," the device will send the source a "fragmentation
needed and Don’t Fragment (DF)-set" ICMP error packet.
Disadvantages of sending ICMP error packets
Sending ICMP error packets facilitates network control and management, but it has the following
disadvantages:
•
Increases network traffic.
•
A device’s performance degrades if it receives a lot of malicious packets that cause it to respond
with ICMP error packets.
•
A host’s performance degrades if the redirection function increases the size of its routing table.
•
End users are affected because of receiving ICMP destination unreachable packets caused by
malicious users.
To prevent such problems, disable the device from sending ICMP error packets.
Configuration procedure
The device stops sending "TTL timeout" ICMP error packets after sending ICMP timeout packets is
disabled. However, "reassembly timeout" error packets will be sent normally.
To enable sending of ICMP error packets:
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable sending of ICMP redirect packets.
ip redirects enable
Disabled by default
3.
Enable sending of ICMP timeout packets.
ip ttl-expires enable
Disabled by default
4.
Enable sending of ICMP destination
unreachable packets.
ip unreachables enable
Disabled by default