I hope someone can help me decipher these packets. How can a non-routable IP send me a Type 3 Code 13 ICMP message when I did not initaiate the connection? Additionally, why do the packets contain a Microsoft IP address (204.79.195.7)?
Ideas?
No. Time Source Destination Protocol Info
1 0.000000 10.22.48.61 000.000.000.000 ICMP Destination unreachable (Communication administratively filtered)
Frame 1 (70 bytes on wire, 70 bytes captured)
Arrival Time: Sep 1, 2009 06:47:04.090053000
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 70 bytes
Capture Length: 70 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:icmp:ip:udp]
[Coloring Rule Name: ICMP errors]
[Coloring Rule String: icmp.type eq 3 || icmp.type eq 4 || icmp.type eq 5 || icmp.type eq 11]
Ethernet II, Src: Bingo_00:00:00 (00:00:00:00:00:00:00), Dst: Bingo_00:00:00 (00:00:00:00:00:00:00)
Destination: Bingo_00:00:00 (00:00:00:00:00:00:00)
Address: Bingo_00:00:00 (00:00:00:00:00:00:00)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Bingo_00:00:00 (00:00:00:00:00:00:00)
Address: Bingo_00:00:00 (00:00:00:00:00:00:00)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.22.48.61 (10.22.48.61), Dst: 000.000.000.000 (000.000.000.000)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 56
Identification: 0xa6bb (42683)
Flags: 0x00
0... = Reserved bit: Not set
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 241
Protocol: ICMP (0x01)
Header checksum: 0x423f [correct]
[Good: True]
[Bad : False]
Source: 10.22.48.61 (10.22.48.61)
Destination: 000.000.000.000 (000.000.000.000)
Internet Control Message Protocol
Type: 3 (Destination unreachable)
Code: 13 (Communication administratively filtered)
Checksum: 0x2c36 [correct]
Internet Protocol, Src: 000.000.000.000 (000.000.000.000), Dst: 204.79.195.7 (204.79.195.7)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 85
Identification: 0x53e0 (21472)
Flags: 0x00
0... = Reserved bit: Not set
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 111
Protocol: UDP (0x11)
Header checksum: 0xc1e9 [correct]
[Good: True]
[Bad : False]
Source: 000.000.000.000 (000.000.000.000)
Destination: 204.79.195.7 (204.79.195.7)
User Datagram Protocol, Src Port: domain (53), Dst Port: domain (53)
Source port: domain (53)
Destination port: domain (53)
Length: 65
Checksum: 0xd011
[Good Checksum: False]
[Bad Checksum: False]
No. Time Source Destination Protocol Info
2 3608.034525 10.22.48.61 000.000.000.000 ICMP Destination unreachable (Communication administratively filtered)
Frame 2 (70 bytes on wire, 70 bytes captured)
Arrival Time: Sep 1, 2009 07:47:12.124578000
[Time delta from previous captured frame: 3608.034525000 seconds]
[Time delta from previous displayed frame: 3608.034525000 seconds]
[Time since reference or first frame: 3608.034525000 seconds]
Frame Number: 2
Frame Length: 70 bytes
Capture Length: 70 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:icmp:ip:udp]
[Coloring Rule Name: ICMP errors]
[Coloring Rule String: icmp.type eq 3 || icmp.type eq 4 || icmp.type eq 5 || icmp.type eq 11]
Ethernet II, Src: Bingo_00:00:00 (00:00:00:00:00:00:00), Dst: Bingo_00:00:00 (00:00:00:00:00:00:00)
Destination: Bingo_00:00:00 (00:00:00:00:00:00:00)
Address: Bingo_00:00:00 (00:00:00:00:00:00:00)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Bingo_00:00:00 (00:00:00:00:00:00:00)
Address: Bingo_00:00:00 (00:00:00:00:00:00:00)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.22.48.61 (10.22.48.61), Dst: 000.000.000.000 (000.000.000.000)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 56
Identification: 0x2710 (10000)
Flags: 0x00
0... = Reserved bit: Not set
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 241
Protocol: ICMP (0x01)
Header checksum: 0xc1ea [correct]
[Good: True]
[Bad : False]
Source: 10.22.48.61 (10.22.48.61)
Destination: 000.000.000.000 (000.000.000.000)
Internet Control Message Protocol
Type: 3 (Destination unreachable)
Code: 13 (Communication administratively filtered)
Checksum: 0xaa78 [correct]
Internet Protocol, Src: 000.000.000.000 (000.000.000.000), Dst: 204.79.195.7 (204.79.195.7)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 74
Identification: 0x552c (21804)
Flags: 0x00
0... = Reserved bit: Not set
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 111
Protocol: UDP (0x11)
Header checksum: 0xc0a8 [correct]
[Good: True]
[Bad : False]
Source: 000.000.000.000 (000.000.000.000)
Destination: 204.79.195.7 (204.79.195.7)
User Datagram Protocol, Src Port: domain (53), Dst Port: domain (53)
Source port: domain (53)
Destination port: domain (53)
Length: 54
Checksum: 0x51da
[Good Checksum: False]
[Bad Checksum: False]
This thread was automatically locked due to age.
