VM Business : ICMP Weirdness

[fizzyade]

Here's an odd one, I'm developing a piece of software that is an open source equivalent of pingplotter.

I've spent this evening, rewriting part of my ping engine as I thought a problem I was seeing was due to the previous implementation, but it persists with the new one. I'm at a bit of a loss as to where the issue is, whether it's inside my network or outside. (I have a opnsense firewall)

However, I can repeat the issue using just the ping tool on macOS.

open a terminal, and execute:

ping -m 2 8.8.8.8

you'll see it respond with TTL exceeded messages.

Now open another terminal:

ping -m 2 1.1.1.1

you should see it respond with TTL exceed messages, but, look at the first ping on my machine it changes to request timeout.

Running Wireshark shows that the request is sent, but replies don't come back.

I might occasionally get a response, but for the most part, it behaves as I've explained above.

Can anybody else repeat this?

I'm on a business account with static IP's.

There is no -m option in windows, so i looked it up for mac

-m ttl Set the IP Time To Live for outgoing packets.

A TTL of 2 isnt going to get you very far, possibly not even off your own network, hence the exceeded messages.

[fizzyade]

Originally Posted by Paul

There is no -m option in windows, so i looked it up for mac



A TTL of 2 isnt going to get you very far, possibly not even off your own network, hence the exceeded messages.

That's the point of this test

With a TTL of 2 and two pings going, the 2nd hop starts to acts very weirdly, one of the pings will correctly show TTL exceeded and the other will show timeout, occasionally switching between which is exceeding and which is timing out.

Virgin appear to be dropping the TTL exceeded packets - but only if there are 2 pings hitting that node, if you have a single ping running it works as expected.

I'm actually writing a piece of software to analyse routes, and I've noticed this issue for a long time but ignored it. Tonight I spent quite a while debugging and figuring out what exactly was going on, it however meant that I reorganised part of the software to make it more robust.

[fizzyade]

I assume there's some sort of rate limiting or some rule is kicking in on that node thinking there's a DDoS or something.