ICMP Weirdness
 

Here's an odd one, I'm developing a piece of software that is an open source equivalent of pingplotter.

I've spent this evening, rewriting part of my ping engine as I thought a problem I was seeing was due to the previous implementation, but it persists with the new one. I'm at a bit of a loss as to where the issue is, whether it's inside my network or outside. (I have a opnsense firewall)

However, I can repeat the issue using just the ping tool on macOS.

open a terminal, and execute:

ping -m 2 8.8.8.8

you'll see it respond with TTL exceeded messages.

Now open another terminal:

ping -m 2 1.1.1.1

you should see it respond with TTL exceed messages, but, look at the first ping on my machine it changes to request timeout.

Running Wireshark shows that the request is sent, but replies don't come back.

I might occasionally get a response, but for the most part, it behaves as I've explained above.

Can anybody else repeat this?

I'm on a business account with static IP's.

Re: ICMP Weirdness
 

There is no -m option in windows, so i looked it up for mac

A TTL of 2 isnt going to get you very far, possibly not even off your own network, hence the exceeded messages.

Re: ICMP Weirdness
 

That's the point of this test ;)

With a TTL of 2 and two pings going, the 2nd hop starts to acts very weirdly, one of the pings will correctly show TTL exceeded and the other will show timeout, occasionally switching between which is exceeding and which is timing out.

Virgin appear to be dropping the TTL exceeded packets - but only if there are 2 pings hitting that node, if you have a single ping running it works as expected.

I'm actually writing a piece of software to analyse routes, and I've noticed this issue for a long time but ignored it. Tonight I spent quite a while debugging and figuring out what exactly was going on, it however meant that I reorganised part of the software to make it more robust.

https://www.cableforum.uk/images/local/2020/12/3.png

Re: ICMP Weirdness
 

I assume there's some sort of rate limiting or some rule is kicking in on that node thinking there's a DDoS or something.