[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ipfilter
Subject:    Re: what does this mean?  ICMP time exceeded / reassembly required
From:       Jim Sandoz <sandoz () alcatel-lucent ! com>
Date:       2007-06-28 15:45:31
Message-ID: 4683D79B.3080902 () alcatel-lucent ! com
[Download RAW message or body]


Ross, Daniel wrote:
>>> yet I am seeing the following:
>>> 7/06/2007 12:36:25.343669 bge0 @0:9 b 10.207.109.92 -> 10.207.3.11
> PR
>>> icmp len 20 576 icmp timxceed/reassem for 10.207.3.11,2049 -
>>> 10.207.109.92,786 PR 17 len 20 1500 IN

the key part is "icmp timxceed/reassem"

http://en.wikipedia.org/wiki/ICMP_Time_Exceeded

"The Time Exceeded Message is an ICMP message which is generated
by a gateway to inform the source of a datagram that the datagram
has been discarded due to the time to live field reaching zero.
A time exceeded message may also be sent by a host if it fails to
reassemble a fragmented datagram within its time limit."

ergo:
either you have a lossy network, a network loop, a routing
misconfiguration, or some similar problem that causes the
symptoms described above.

ps:
why is it so difficult to use a proper subject line on your
post, so that the next guy who encounters a similar problem
can have half a chance of successfully googling this thread
from the ipfilter mailing list archives?

jim

[prev in list] [next in list] [prev in thread] [next in thread]