Re: Any idea what this is?

From: Lew Pitcher (Lew_Pitcher@td.com)
Date: 03/26/02 

From: Lew_Pitcher@td.com (Lew Pitcher)
Date: Tue, 26 Mar 2002 18:23:49 GMT

On Tue, 26 Mar 2002 12:12:50 -0600, David <thunderbolt01@netscape.net>
wrote:

>Anyone know what this log message is about? I have been getting a lot of
>them lately.
>
>Mar 26 09:09:08 www kernel: Packet log: input REJECT ppp0 PROTO=1

Protocol 1 is ICMP

>207.68.179.148:3 MY_IP:13 L=56 S=0x00 I=46480 F=0x0000 T=240 (#10)

For ICMP messages, the ICMP 'type' is reported as the source port
and the ICMP 'code' is reported as the target port.

Here, the source port = 3, which should be interpreted as an ICMP
'Destination Unreachable' message, and the target port is 13, which should
be interpreted as 'Communication Administratively Prohibited (RFC1812)",

So, IP address 207.68.179.148 is telling you that some packet you sent
couldn't be delivered because your target address/port (their source
address) is administratively blocked from receiving your datagrams.

FWIW, RFC1812 says of the "Communication Administratively Prohibited" code:

 13 = Communication Administratively Prohibited - generated if a
        router cannot forward a packet due to administrative filtering;

>
>I know the address is from Microsoft's MSN Net Block.
>
>
>
>MSN (NETBLK-MSN-BLK)
> One Redmond Way
> Redmond, WA 98052
> US
>
> Netname: MSN-BLK
> Netblock: 207.68.128.0 - 207.68.207.255
>Maintainer: MSN
>
>
>--
>Confucius say: He who play in root, eventually kill tree.
>Registered with the Linux Counter. http://counter.li.org
>ID # 123538
>
>

Lew Pitcher, Information Technology Consultant, Toronto Dominion Bank Financial Group
(Lew_Pitcher@td.com)

(Opinions expressed are my own, not my employer's.)

Quantcast