Wireshark-users: Re: [Wireshark-users] Ping Replys without Request

From: "ronnie sahlberg" <ronniesahlberg@xxxxxxxxx>
Date: Mon, 28 Aug 2006 09:03:57 +0000
ICMP echo repliy are only sent ever as a response to an ICMP echo request.

If you tryly get unsolicited echo replies coming back with no echo
request it is definitely a bug in the stack.



Any TCP layer errors/issues would generage
ICMP destination unreachable/port unreachable if you try to connecto
to a port behind which no service is listening (or you may get TCP
RST)
ICMP destination unreachable/port administratively prohibited    is
you have a wellbehaved firewall that blocks the traffic (most
firewalls are admined by clueless people so they are configured not to
return this though :-( )
ICMP parameter error   if the tcp segment is malformed   maybe with
incorrect checksum on the tcp layer or using ip or tcp options that
are not understood and not accepted.



On 8/28/06, STEINECKE Michael SD-G (AREVA NP GmbH)
<Michael.Steinecke@xxxxxxxxx> wrote:
Hello folks,

i've a bit strange issue in the communication between a Server and his
client (a microcontroler).
The controler send "Echo Reply" packets without a corresponding  ICMP
requests. Is there another way how this can happen then an program or
firmware error? Something like an TCP packet that requests a ICMP Echo
par example?

Best Regards
Michael Steinecke