when trying to debug this with
netstat i was not able to see any icmp traffic with it, so i tried with
ss, but even then i didn't see any application, so i tried to run ping to one of my hosts and i was able to see it in the output of
ss -anpw (
-w for raw socket)
This is when i returned to wireshark and start looking more closely on the packets, and then it hit me ... (see Part #2).
Seems like i miss understand wireshark output, the packets were ICMP, but not echo/reply types but a respond from my Firewall (iptables) to incoming connections.
In my iptables there is this line
-A INPUT -j REJECT --reject-with icmp-host-prohibited
which will reply with ICMP Type: 3 (Destination unreachable) and Code: 10 (Host administratively prohibited) for any incoming connection which don't match any rule.
It seems that my problem was caused by white-listing the ports for my torrent client, but they were in HOME zone chain, and for some reason my default policy for my Home connection was set to default/public.
After setting the zone for the interface (and having the whitelisted port in the iptable chain) I stop seeing the above ICMP message.