Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[DirtyDawg]

[INFO] Sat Feb 13 04:34:44 2010 Blocked incoming ICMP error message (ICMP type 11) from xx.xxx.xx.xx to xx.xxx.xxx.xx as there is no TCP connection active between xx.xxx.xxx.xx:xxxxx and xxx.xx.xxx.xx:xx


I took the ip addresses out for obvious reasons, but what the heck is going on here?  Can someone give me some help stopping this?  This type of thing is beginning to happen multiple times a day and I'm not familiar enough with the settings for this type of router to fix this.  Hopefully it is a setting and one of you can give me some info as to how to straighten this out.  I called my ISP the other day kind of blaming them for this crap before I even looked in the logs of the 655.  Is there anyway to stop this short of getting another router?  Thanks.

[EddieZ]

Have you even looked at what this ICMP type 11 is? If you had just used Google, you would have found out that this is:
Type 11     Time Exceeded           Used in traceroute, probes

So probably your IP is being probed, but since you left out all the IP details it is impossible to say whether there's probing from inside your LAN or from the WAN side.

Anyway, the error itself is absolutely not something to worry about and you should be thankful you're router is functioning like it should!

[DirtyDawg]

Hey, I appreciate your input.  Is it really normal for the service to stop everytime this happens?  Every time (well maybe 75% of the time) I see my service go out (and the modem lights are blinking in such a way that it indicates service has been interrupted), I look in the log and I see that message in the log that I put in my original post.  I took a look at the unfamiliar ip address and it turned out to be from China (according to WHOIS),  so you're probably right about the probing, but should it interrupt my service?  I don't think it should, should it?


  I don't always think about googling.  Thanks for the reminder that google is my friend .


Any further input?

[Cobra]

ICMP can be enabled if it is required by your ISP (although I do not know why) or you just want the router to be pingable.

Advanced > Advanced Network > WAN Ping

[EddieZ]

Network load can bring down any router or service simply by overflowing the device's memory

[DirtyDawg]

Absolutely not.  No I don't want the router answering ping requests, not from outside of the LAN anyway.  Any kind of security equipment, such as a router, would need to silently ignore that, I would think.  In fact, there is this site dedicated to helping inidviduals (and individuals machines) silent while they are online.  www.grc.com is that site, and I have been going there for years to make sure that my machine (including any routers, or software firewalls...etc.) is running silently and I'm not broadcasting to any potiential hackers that my system is vulnerable.  Thanks for your input.

ICMP can be enabled if it is required by your ISP (although I do not know why) or you just want the router to be pingable.

Advanced > Advanced Network > WAN Ping

[DirtyDawg]

They would first have to know that there was a vulnerable system somewhere wouldn't they?  That is exactly why I don't broadcast any ip addresses that are associated with my machine/and/or ISP.  I've went to a certain site called www.grc.com for years to make sure my security is set up right, be it router or software.  It has served me very well going there.  Thanks for your input.

Network load can bring down any router or service simply by overflowing the device's memory

[EddieZ]

They would first have to know that there was a vulnerable system somewhere wouldn't they?  That is exactly why I don't broadcast any ip addresses that are associated with my machine/and/or ISP.  I've went to a certain site called www.grc.com for years to make sure my security is set up right, be it router or software.  It has served me very well going there.  Thanks for your input.

Which is quite easy when your client is infected.
And they can trace your IP anyway, unless you use proxy servers. GRC is a good site for the general public, but the tips are no remedy against a die hard hacker.

[Cobra]

They would first have to know that there was a vulnerable system somewhere wouldn't they?  That is exactly why I don't broadcast any ip addresses that are associated with my machine/and/or ISP.  I've went to a certain site called www.grc.com for years to make sure my security is set up right, be it router or software.  It has served me very well going there.  Thanks for your input.

You broadcast your IP anywhere you go on the WWW and anytime you download a file, check email, etc.

You broadcast your IP through every hop of the route to whatever you do on the WWW.

ICMP ping through the router is just the router replying not your PC's.

[DirtyDawg]

Thanks for the input.  I kind of figured that it was the router either answering/or NOT, as all of the household systems are behind the routers firewall, and each system has its own LAN IP address.  I also, in the back of my head anyway, know that the Internet ip address assigned by the isp is broadcasted pretty much everywhere I go on the WWW.  However, this is the first time that I've been able to associate ISP service being interrupted and remain that way for quite a long period, and someone trying to gain access to my ISP's IP address.  I've been online for many many years, had multiple "different" routers...etc., and my service has never been interrupted in this manner before.  I guess there is nothing I can do about it?  Is that right?  Maybe report the foreign IP address to my provider?

You broadcast your IP anywhere you go on the WWW and anytime you download a file, check email, etc.

You broadcast your IP through every hop of the route to whatever you do on the WWW.

ICMP ping through the router is just the router replying not your PC's.

[EddieZ]

There's a first time for everything. Past experience has no value towards he future...

You can report it, but that's like bringing water to the sea...

[DirtyDawg]

   Good point.  I'd like to know what they have to say about it though.  I'll just tell them that the constant interruptions of service is linked to that and if they ask for the IP addresses, then I'll fork em over.

Thanks for your input.

There's a first time for everything. Past experience has no value towards he future...

You can report it, but that's like bringing water to the sea...

[DirtyDawg]

Ok, talked to my ISP and they checked their logs in association with my modem (which is connected obviously to their system) and they don't show any interruption of service going to the modem at all.  It hasn't reset or anything of that sort.  So the router must be cutting service between itself and the modem preventing internet service.  At the same time though, I still have access on the LAN side.  Isn't that a little odd?  Well to me it is.  When this problem occurs, I can see on the router status page that there is NO IP ADDRESS (the internet side) no default gateway...nothing in relation to my ISP in the router page at all.  But I can still do things via the LAN.  Does this mean that the router maintains the "internet side" IP address in memory somewhere without it being shown on the router "Status" page?  Otherwise how could there be any activity on the LAN side?  Isn't that dependent on the router having an IP address from my ISP?  I'm a little confused here.      

[Cobra]

What firmware are you using on the router?

[DirtyDawg]

Firmware Version is 1.21 - Hardware Version is A4 just in case you need that as well.  I sure hope you're not thinking of telling me I need to upgrade.  I would of course if it is necessary, but am a little leary from all of the problems described on this forum from some of those that have upgraded.

Thanks for your input.

What firmware are you using on the router?