This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Report Inconsistencies

On the front page of network protection, the top dropped service / destination host is a service called icmp/t3c1. At the moment, it shows 730 dropped packets. When I bring up the report of top services, the top entry is icmp, with the 730 packets. When I click on the service for more detail it's blank. When I try to view the detail for other services, I get a list of ip addresses, but not for this one. Also, the name is strange in comparison to the others that have a port number. Is there an explanation for this?

This thread was automatically locked due to age.

Parents

0 apijnappels over 12 years ago

I think this is ICMP type 3 which is Destination unreachable....
Cancel
Vote Up 0 Vote Down

Cancel
0 bimmerdriver over 12 years ago in reply to apijnappels

Here are some screen captures.

First, top dropped destination / services:

Note lines 1 and 7. I thought the part after the protocol was supposed to be a port number. If so, why do they have an alphabetic character?

Second, top services:

Note line 1 has 404 packets.

Third, report on line 1:

When I look at the report to see where the packets came from, the report is blank.

Normally, this report would show the source hosts for the service.

Is there a reason for these particular ICMP services to work this way?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 bimmerdriver over 12 years ago in reply to apijnappels

Here are some screen captures.

First, top dropped destination / services:

Note lines 1 and 7. I thought the part after the protocol was supposed to be a port number. If so, why do they have an alphabetic character?

Second, top services:

Note line 1 has 404 packets.

Third, report on line 1:

When I look at the report to see where the packets came from, the report is blank.

Normally, this report would show the source hosts for the service.

Is there a reason for these particular ICMP services to work this way?
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Billybob over 12 years ago in reply to bimmerdriver

Those are ICMP type 3 with different codes and are categorized correctly. This gives you more information in the report than just calling it ICMP. ICMP type 3, Destination unreachable message

On the second screenshot, what happens if you click on 1 (ICMP) or 6 icmp, do you get zero results as in screenshot 3?
Cancel
Vote Up 0 Vote Down

Cancel
0 bimmerdriver over 12 years ago in reply to Billybob

Those are ICMP type 3 with different codes and are categorized correctly. This gives you more information in the report than just calling it ICMP. ICMP type 3, Destination unreachable message

On the second screenshot, what happens if you click on 1 (ICMP) or 6 icmp, do you get zero results as in screenshot 3?
Thanks for the reply. There are three ICMP lines in the report and I get zero results for all of them.
Cancel
Vote Up 0 Vote Down

Cancel
0 bimmerdriver over 12 years ago in reply to Billybob

Those are ICMP type 3 with different codes and are categorized correctly. This gives you more information in the report than just calling it ICMP. ICMP type 3, Destination unreachable message

On the second screenshot, what happens if you click on 1 (ICMP) or 6 icmp, do you get zero results as in screenshot 3?
Do you get the same results when you use this query?
Cancel
Vote Up 0 Vote Down

Cancel