Joe, It is not PINGABLE at the size of 50, but anything 48 or smaller will respond to the PING..... very interesting...
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe Sepielli Sent: Wednesday, October 08, 2003 1:47 PM To: [EMAIL PROTECTED] Subject: Re: [WhatsUp Forum] ICMP Failure Brian, It is possible that the router is blocking ICMP packets of a specific length? To test this theory try this: Tools->Net Tools->Ping. Set the size to 50. If that fails, try other sizes to determine if this is the case. Regards, Joe PS: See the discussion below for details from my associate Mark Symons: The packet size cannot be changed in WhatsUp Gold v8.01. The ICMP packets used by WhatsUp Gold have a data size of 50 bytes, = giving a total packet size of 78 bytes when headers, etc, are factored = in. Now, this is smaller than the 92 bytes that you cite for the = nachi/welchia worm. So your filtering should work in theory. Could you = try and set the cut-off somewhere between (say) 80 and 88? Anyway, I logged a request into our database a couple of days ago for = the WhatsUp Gold ICMP packet size to be reduced to 64 bytes (minimum = Ethernet packet size). I will update the database so that it has your = report as well. Mark Symons Ipswitch, Inc Augusta GA -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Eric Helm Sent: Thursday, September 04, 2003 10:23 To: [EMAIL PROTECTED] Subject: [WhatsUp Forum] Change ICMP packet size Is there any way to change the size of the ICMP packets that are used = for polling devices in WhatsUp Gold 7? I am wanting to implement traffic shaping to drop 92 byte icmp packets = used by the nachi/welchia worm to scan for vulnerable hosts and as soon as I implement this change my whatsup maps show all my devices down. Any help would be great.. Eric Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ In reply to 7 Oct message from [EMAIL PROTECTED]: >This is a multi-part message in MIME format. >------=_NextPart_000_0032_01C38CEE.FE0D5EA0 >Content-Type: text/plain; > charset="us-ascii" >Content-Transfer-Encoding: 7bit >ICMP Failure- > >My WhatsUpGold software is showing it can not ping a router, but >from the actual server, I can ping it just find from the command >line. Anyone ever see this before? > >-bb > > >Brian Boles >Network Administrator >Power Pulse Communications >[EMAIL PROTECTED] >------=_NextPart_000_0032_01C38CEE.FE0D5EA0 >Content-Type: text/html; > charset="us-ascii" >Content-Transfer-Encoding: quoted-printable ><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> ><html xmlns:o=3D"urn:schemas-microsoft-com:office:office" = >xmlns:w=3D"urn:schemas-microsoft-com:office:word" = >xmlns=3D"http://www.w3.org/TR/REC-html40";> ><head> ><META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = >charset=3Dus-ascii"> ><meta name=3DProgId content=3DWord.Document> ><meta name=3DGenerator content=3D"Microsoft Word 10"> <meta >name=3DOriginator content=3D"Microsoft Word 10"> <link >rel=3DFile-List href=3D"cid:[EMAIL PROTECTED]"> ><title>Message</title> ><!--[if gte mso 9]><xml> > <o:OfficeDocumentSettings> > <o:DoNotRelyOnCSS/> > </o:OfficeDocumentSettings> ></xml><![endif]--><!--[if gte mso 9]><xml> > <w:WordDocument> > <w:DocumentKind>DocumentEmail</w:DocumentKind> > <w:EnvelopeVis/> > <w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel> > </w:WordDocument> ></xml><![endif]--> ><style> ><!-- > /* Style Definitions */ > p.MsoNormal, li.MsoNormal, div.MsoNormal > {mso-style-parent:""; > margin:0in; > margin-bottom:.0001pt; > mso-pagination:widow-orphan; > font-size:12.0pt; > font-family:"Times New Roman"; > mso-fareast-font-family:"Times New Roman";} >a:link, span.MsoHyperlink > {color:blue; > text-decoration:underline; > text-underline:single;} >a:visited, span.MsoHyperlinkFollowed > {color:blue; > text-decoration:underline; > text-underline:single;} >p > {mso-margin-top-alt:auto; > margin-right:0in; > mso-margin-bottom-alt:auto; > margin-left:0in; > mso-pagination:widow-orphan; > font-size:12.0pt; > font-family:"Times New Roman"; > mso-fareast-font-family:"Times New Roman";} >span.EmailStyle18 > {mso-style-type:personal-reply; > mso-style-noshow:yes; > mso-ansi-font-size:10.0pt; > mso-bidi-font-size:10.0pt; > font-family:Arial; > mso-ascii-font-family:Arial; > mso-hansi-font-family:Arial; > mso-bidi-font-family:Arial; > color:navy;} >@page Section1 > {size:8.5in 11.0in; > margin:1.0in 1.25in 1.0in 1.25in; > mso-header-margin:.5in; > mso-footer-margin:.5in; > mso-paper-source:0;} >div.Section1 > {page:Section1;} >--> ></style> ><!--[if gte mso 10]> ><style> > /* Style Definitions */=20 > table.MsoNormalTable > {mso-style-name:"Table Normal"; > mso-tstyle-rowband-size:0; > mso-tstyle-colband-size:0; > mso-style-noshow:yes; > mso-style-parent:""; > mso-padding-alt:0in 5.4pt 0in 5.4pt; > mso-para-margin:0in; > mso-para-margin-bottom:.0001pt; > mso-pagination:widow-orphan; > font-size:10.0pt; > font-family:"Times New Roman";} ></style> ><![endif]--> ></head> ><body lang=3DEN-US link=3Dblue vlink=3Dblue >style=3D'tab-interval:.5in'> ><div class=3DSection1> ><blockquote = >style=3D'margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'> ><div> ><p class=3DMsoNormal><font size=3D3 color=3Dnavy face=3D"Times New >= Roman"><span >style=3D'font-size:12.0pt;color:navy'>ICMP = >Failure-<o:p></o:p></span></font></p> ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p > ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'>My WhatsUpGold software is >showing = it can >not ping a router, but from the actual server, I can ping it just >find = from the >command line…<o:p></o:p></span></font></p> ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'>Anyone ever see this = >before?<o:p></o:p></span></font></p> ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p > ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'>-bb<o:p></o:p></span></font></p> ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p > ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p > ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'>Brian = >Boles<o:p></o:p></span></font></p> ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'>Network = >Administrator<o:p></o:p></span></font></p> ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'>Power Pulse = >Communications<o:p></o:p></span></font></p> ><p class=3DMsoNormal><font size=3D2 color=3Dnavy >face=3DArial><span = style=3D'font-size: >10.0pt;font-family:Arial;color:navy'><a = >href=3D"mailto:[EMAIL PROTECTED]">[EMAIL PROTECTED]</a> ><o:p></o:p></span></font></p> ></div> ></blockquote> ></div> ></body> ></html> >------=_NextPart_000_0032_01C38CEE.FE0D5EA0-- >Please visit http://www.ipswitch.com/support/mailing-lists.html to >be removed from this list. >An Archive of this list is available at: >http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
