ping provides vague message `Packet filtered'

[Ian Jackson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 affects /distros/ubuntu/iputils

root@edgy:~# ping 172.18.45.41
PING 172.18.45.41 (172.18.45.41) 56(84) bytes of data.
- From 172.18.45.41 icmp_seq=1 Packet filtered

root@samual8:~# tcpdump -x -vvs500 -lnivif16.0
tcpdump: listening on vif16.0, link-type EN10MB (Ethernet), capture size 500 byt
es
12:35:41.462555 arp who-has 172.18.45.41 tell 172.18.45.66
        0x0000: 0001 0800 0604 0001 0016 3e7c aa7f ac12
        0x0010: 2d42 0000 0000 0000 ac12 2d29
12:35:41.462782 arp reply 172.18.45.41 is-at fe:ff:ff:ff:ff:ff
        0x0000: 0001 0800 0604 0002 feff ffff ffff ac12
        0x0010: 2d29 0016 3e7c aa7f ac12 2d42
12:35:41.463059 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto: ICMP (1
), length: 84) 172.18.45.66 > 172.18.45.41: ICMP echo request, id 15627, seq 1,
length 64
        0x0000: 4500 0054 0000 4000 4001 8819 ac12 2d42
        0x0010: ac12 2d29 0800 d910 3d0b 0001 0d8e d044
        0x0020: 120d 0700 0809 0a0b 0c0d 0e0f 1011 1213
        0x0030: 1415 1617 1819 1a1b 1c1d 1e1f 2021 2223
        0x0040: 2425 2627 2829 2a2b 2c2d 2e2f 3031 3233
        0x0050: 3435 3637
12:35:41.463112 IP (tos 0xc0, ttl 64, id 43140, offset 0, flags [none], proto:
ICMP (1), length: 112) 172.18.45.41 > 172.18.45.66: ICMP host 172.18.45.41 unrea
chable - admin prohibited filter, length 92
        IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto: ICMP (1), lengt
h: 84) 172.18.45.66 > 172.18.45.41: ICMP echo request, id 15627, seq 1, length 6
4
        0x0000: 45c0 0070 a884 0000 4001 1eb9 ac12 2d29
        0x0010: ac12 2d42 030d fcf2 0000 0000 4500 0054
                           ^^^^ ICMP type 3 code 13
        0x0020: 0000 4000 4001 8819 ac12 2d42 ac12 2d29
        0x0030: 0800 d910 3d0b 0001 0d8e d044 120d 0700
        0x0040: 0809 0a0b 0c0d 0e0f 1011 1213 1415 1617
        0x0050: 1819 1a1b 1c1d 1e1f 2021 2223 2425 2627
        0x0060: 2829 2a2b 2c2d 2e2f 3031 3233 3435 3637

4 packets captured
8 packets received by filter
0 packets dropped by kernel
root@samual8:~#

I note that even tcpdump has been contaminated with the imprecise term
`filter' and it has also inaccurately described the message as `host
unreachable' when in fact it's `Destination Unreachable' (type 3) code
13 `Communication Administratively Prohibited' which doesn't specify
`host' as opposed to `network'.

ping should say something precise and accurate, such as
 ICMP dest unreach - comm admin prohib

If you really must say `packet filtered' for the benefit of
ignoramuses, you could say
 ICMP dest unreach - comm admin prohib (Packet filtered)
for code 13.

This message would go along with
 ICMP dest unreach - net admin prohib (Packet filtered)
 ICMP dest unreach - host admin prohib (Packet filtered)
for ICMP codes 9 and 10 respectively.

References:
 ICMP type 3 (destination unreachable): RFC792 page 3.
 ICMP dest unreach codes 9 and 10: RFC1122 s3.2.2.1.
 ICMP dest unreach code 13: RFC1812 s5.2.7.1.

I will be reporting a separate bug about the inaccurate output from
tcpdump.

Ian.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFE0JLa8jyP9GfyNQARAk4wAJ90dg7LALO3B74S1EMzZH2pH6g7gwCeJ3qv
UQCPooz+C72p80AzYhWkXoo=
=+cO/
-----END PGP SIGNATURE-----

[Paul Dufresne (paulduf)]

Thank you for this remark.
Changing state from new to Confirmed, as there is enough info to let developer decide what to do next.

[Josh (majik)]

This seems like working as expected to me.

It is correctly informing you that the ICMP packet was filtered by some router in between your computer and the destination.

Ping only knows that the packet was filtered, it doesn't know why and it is not Ping's job to figure out why the packet was filtered.

[Ian Jackson (ijackson)]

Josh writes ("[Bug 54925] Re: ping provides vague message `Packet filtered'"):
> Ping only knows that the packet was filtered, it doesn't know why and it
> is not Ping's job to figure out why the packet was filtered.

You are entirely wrong. ping has the complete ICMP unreachable
packet, with the reason code, as my tcpdump demonstrates. Please also
read the references I gave.

Ian.