My firewall (
iptables) logs some strange ICMP type 3 code 10 traffic that I am curious to understand (specifically how or if this could be an exploit of some sort).
The logged traffic (4-6 packets a few seconds apart, once a day for the last months):
IN=eth0 OUT= MAC=(eth0 MAC) SRC=(Foreign IP address) DST=(My IP address) LEN=72 TOS=0x00 PREC=0x00 TTL=50 ID=35145 PROTO=ICMP TYPE=3 CODE=10 [SRC=(My IP address) DST=(Foreign IP address) LEN=44 TOS=0x00 PREC=0x00 TTL=50 ID=0 DF PROTO=TCP SPT=25 DPT=53454 WINDOW=28200 RES=0x00 ACK SYN URGP=0]
All logs indicate that (Foreign IP address) only transmits the above ICMP packet.
No other traffic from (Foreign IP address) is recorded in the same time period (see update below).
By default, the system logs and drops any traffic originating from the country of (Foreign IP address).
Could this be an exploit, perhaps to trick (My IP address) into transmitting something to (Foreign IP address), assuming I did not drop the traffic by default?
Any insights are welcome.
Update: The logs show that (Foreign IP address) consistently connects to port 80 and 443 prior to the ICMP packets (9 and 7 hours before the ICMP packets, respectively). Both attempts dropped by the default firewall policy.
According to Network-Tools.com the origin of (Foreign IP address) is China(CN) in region Southern and Eastern Asia, and no host name is associated with the IP address.