RE: [FW1] Need help understanding "snoop" output

["Sterling, Chuck" <csterlin@FW1-NOSPAMsmtp3.wstf.nasa.gov>]

Thanks for the reply. Yes, you're right, the path to 194.102.91.1 ends in a
router loop, at least as of yesterday when I was watching. 

So far as I can see, there is no outbound traffic to that address, or to
207.88.240.101 or 207.88.240.105 (another address doing the same bit), other
than my ping and traceroute attempts. The local address is not in use, so I
doubt that packet is in response to a request from any system on my network.
I do not understand why the 194.102.91.1 address AND the 207.88.240.101
address are in the packet. The firewall lists 207.88.240.101 as the source
address in the log, so what does 194.102.91.1 have to do with it? 

As to allowing these through the firewall, this particular packet is
addressed to a non-existent machine, as are most of the similar packets
supposedly arriving from 207.88.240.101 (and 207.88.240.105). Randomly
addressed inbound packets, like these, are always dropped. 

Thanks again,
Chuck Sterling


> ----------
> From: 	Roy G. Culley[SMTP:tgdcuro1@gd2.swissptt.ch]
> Sent: 	Friday, November 03, 2000 3:35 AM
> To: 	Sterling, Chuck
> Subject: 	Re: [FW1] Need help understanding "snoop" output
> 
> Hi,
> 
> What you are seeing is not ping traffic but icmp destination
> unreachable messages. The host 194.102.91.1 is not reachable.
> You should allow these icmp messages through your firewall.
> 
> Regards,
> Roy
> 


================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================