My logs over the last day have started filling up with the following entry - I’m getting about two hits a minute, could anyone explain what this is and if it is cause for concern?
Block - ICMP - Type(3) - Code(13)
I have checked online to find out the meaning of these codes and came up with…
ICMP - Destination Unreachable - Communication Administratively Prohibited.
This is generated if a router cannot forward a packet due to administrative filtering.
But this has not really cleared up for me exactly what this traffic is and why I’m getting so much of it!
You can Google on “RIPE Network Coordination Center”, but something in your system seems to be sending messages to a European Internet Authority and getting some of them rejected. Probably some sort of normal traffic, but don’t know why a lot of stuff happens on the internet.
ICMP 3 subcode 13 is a router firewall message. What that means, is the packets going out from your machine to some destination are being blocked by a router and its firewall. Cisco boxes do things like this. FreeBSD machines configured as routers can do it with their firewall setup using an ‘ipfw unreach filter-prohib’ command.
Which router is it? You’ll have to use a tracert to your destination. It’ll be one of the ISP-backbone hops.
Note that ISP’s don’t firewall traffic without a very good reason. Either the destination site has their routing all messed up (router loop kind of thing), or there is a compromised site somewhere in the same IP address block and they’ve just sealed off the are until things get cleaned up.