On Dec 3, 2009, at 7:08 PM, Patrick Domack wrote: > I was diagnosing a completely unrelated issue and saw these in my tcpdumps > and though I would inspect more. > > I noticed to my ntp server in the pool, craploads of icmp requests per second > (about 1/50th the amount of ntp requests). > > Most of these send several icmp requests every so often, then an ntp request. > > Just wondering if anyone knows what this is?
You'd have to provide a few more details about what type of ICMP traffic you are seeing. ICMP host/network unreachable or "administratively prohibited" message types commonly are from misconfigured or brain-dead firewalls that permit their internal networks to send out NTP queries but reject the NTP replies sent back with an ICMP error message. > I have noticed it from a few nat gateways. but then I am also seeing it from > a large continuous ip space from ibm. You should contact [email protected] or whoever the listed whois contact for these IPs are. Regards, -- -Chuck _______________________________________________ timekeepers mailing list [email protected] https://fortytwo.ch/mailman/cgi-bin/listinfo/timekeepers
