Date: Fri, 16 Jul 1999 11:42:29 +1200 From: "Craig Harding" <crh@outpost.co.nz> To: freebsd-net@freebsd.org Subject: ICMP Redirect Floods Message-ID: <19990715234403.751451562C@hub.freebsd.org>
next in thread | raw e-mail | index | archive | help
I'm having a weird problem with our ISP's router that they seem unable to fix and I can't quite follow what's happening. We've got a small LAN, running NATD'd via a FreeBSD gateway server which connects through a centrex (and hence permanent) ISDN link to our ISP. The server has a real, static IP number. Earlier this week we started having problems with the ISDN TA hanging up and reconnecting. I've got LQR monitoring enabled on the PPP link (using usermode PPP), and it turns out PPP was hanging up because occasional floods of ICMP redirect messages from the ISPs router were saturating the PPP link and preventing sufficient LQR packets from getting through. I do mean saturating - 1MB of ICMP redirects received at up to 20kB/s on a 128kb/s ISDN link. The ICMP redirect floods are some side effect of the transparent proxy cache the ISP runs which intercepts all HTTP traffic. They only occur when attempting to access the web from one of the PCs on our LAN, running Win98 and Netscape 4.06. The salient point is that this PC alone has also been allocated a real IP address, while all other PCs here are on 192.168.1.x. HTTP traffic from any other PC (or the Mac, or the FreeBSD gateway server via Lynx) causes no untoward effects. The PC with the real address actually has a private IP, with the static address given to it by a static 1-1 translation link in NATD. The ISP has been particularly unsuccessful at even beginning to resolve the problem, so in the first instance I turned off LQR monitoring on the PPP link to keep the line up. I then blocked ICMP redirects at my firewall on the gateway FreeBSD box, and here's where the wierdness starts - bingo, no more floods. I don't mean they're just now being blocked, I mean the floods no longer happen at all. And this is where we come up against my limited experience with IP. I can't understand how, if IPFW is blocking ICMP redirects and silently dropping them on the floor instead of passing them on to the Windows PC, the router at the ISP is somehow finding out about this change of behaviour and doing something different as a result? I've run tcpdumps and I can't see any traffic flowing back from the gateway server or he Windows PC that would alert the router that something's changed - the only thing going out are the HTTP requests from the PC. Does anyone have any idea what's going on, I'm stumped? Is there some characteristic of the PPP link that passes information about the blocked traffic back to their terminal server which then informs the router? Is there something really obvious that I've missed because I'm a stupid goombah? And what's causing those redirect floods in the first place? -- C. -- Craig Harding crh@outpost.co.nz "I don't know about God, I Outpost Digital Media Ltd crh@inspire.net.nz just think we're handmade" http://www.outpost.co.nz ICQ# 26701833 - Polly To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19990715234403.751451562C>