Skip to main content
dennislo
New Member
April 16, 2012
Question

unknown icmp log

  • April 16, 2012
  • 5 replies
  • 4344 views
I found one of my vdom have many traffic log with the service 3/3/icmp allowed. I only permitted DNS traffic in my policy and icmp should be blocked. Also, I did not enable " log allowed traffic" , so it makes me don' t understand why I would got such traffic log on my fortigate. Can anyone tell us what are those log and why it appears on the traffic log? Below is the one of the raw log as I said: log_id=5 type=traffic subtype=other pri=notice vd=*** status=" accept" dir_disp=" org" tran_disp=" noop" src=" 10.***.***.***" srcname=" 10.***.***.***" src_port=0 dst=" 10.***.***.***" dstname=" 10.***.***.***" dst_country=" Reserved" dst_port=771 tran_ip=" N/A" tran_port=0 tran_sip=" N/A" tran_sport=0 service=" 3/3/icmp" proto=1 app_type=" N/A" duration=0 rule=18 policyid=18 identidx=0 sent=0 rcvd=0 shaper_drop_sent=0 shaper_drop_rcvd=0 perip_drop=0 shaper_sent_name=" n/a" shaper_rcvd_name=" n/a" perip_name=" n/a" sent_pkt=0 rcvd_pkt=0 vpn=" n/a" vpn_type=" n/a" vpn_tunnel=" n/a" src_int=" WC-Trust" dst_int=" WC-UnTrust" SN=********** app=" N/A" app_cat=" N/A" user=" n/a" group=" n/a" carrier_ep=" N/A" profilegroup=" N/A"

    5 replies

    ede_pfau
    SuperUser
    SuperUser
    April 16, 2012
    This is a ' destination network unreachable' ICMP message, type=3, code=3, that is, ' port unreachable' . The host on WC-Trust subnet tried to contact a host on ' WC-UnTrust' on port 771 which was not open for listening. See RFC 792 for details on ICMP.
    dennislo
    dennisloAuthor
    New Member
    April 16, 2012
    Hi Ede, thank you for your explanation!
    LCT
    New Member
    April 19, 2012
    Do you have sflow enabled and is one of the ip' s the sflow receiver host? Edit: Forget what I asked. I had a similar situation, but with policy id " 0" . My log filled up with this type of log messages 3/3/icmp dst_port 771. But I also have this log messages with a host in a accept rule. It' s a monitoring host which ping devices, it' s strange, the devices are up and reply to the ping but my firewall log show them all the time.
    mdefosse
    New Member
    October 10, 2012
    Hi, I have the same problem. Have you find any solution to disable / resolve this ? Thanks
    dennislo
    dennisloAuthor
    New Member
    October 10, 2012
    hi mdefosse, As edu_pfau said, the 3/3/icmp log were caused by port unreachable messages. I found those messages are from my clients' DNS server, which their server settings was not completed, after they modified their DNS server settings, the 3/3/icmp log was gone.
    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
    Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT