2

​ I'm having problem with this,

Something in my system (Linux/Fedora 24/x64) keep sending ping's to several IP address, and i like to know which process is responsible for this.

I found several articles (and answers) to use auditctl but it didn't work for me.

Update: found my problem, see it in the answers below.


  • I'm guessing you are interested in solutions for Linux, but that might be worth mentioning. – ilkkachu Aug 30 '16 at 7:55
  • thanks you are right, just added and updated the question with more information. – Rabin Aug 30 '16 at 10:10
1

I suggest you run:

tcpdump -nni ethernet_interface icmp

Get the Ethernet_interface by typing ifconfig. It's usually eth0 (macs use en0). Look for the interface with your IP beside it.

You'll see ICMP echo requests with:

IP > Your_IP   

Once you find the IP that's sending the requests, that page you linked shows how to use netstat to find the process ID (pid). Log into the IP that is sending (if you have rights) and run a netstat there.

  • Care to elaborate where you get the PID of the program that emits the ICMP packets? – Julie Pelletier Aug 30 '16 at 3:10
  • @Julie Pelletier, I was able to capture this with ss and raw sockets, run a ping command to some host and run ss -anpw to see it. – Rabin Aug 30 '16 at 10:08
  • @Rabin: That does provide a very good answer. You should make an answer with it. – Julie Pelletier Aug 30 '16 at 14:05
1

Part 1:

when trying to debug this with netstat i was not able to see any icmp traffic with it, so i tried with ss, but even then i didn't see any application, so i tried to run ping to one of my hosts and i was able to see it in the output of ss -anpw (-w for raw socket)

This is when i returned to wireshark and start looking more closely on the packets, and then it hit me ... (see Part #2).

Part 2:

Seems like i miss understand wireshark output, the packets were ICMP, but not echo/reply types but a respond from my Firewall (iptables) to incoming connections.

In my iptables there is this line

-A INPUT -j REJECT --reject-with icmp-host-prohibited

which will reply with ICMP Type: 3 (Destination unreachable) and Code: 10 (Host administratively prohibited) for any incoming connection which don't match any rule.

It seems that my problem was caused by white-listing the ports for my torrent client, but they were in HOME zone chain, and for some reason my default policy for my Home connection was set to default/public.

After setting the zone for the interface (and having the whitelisted port in the iptable chain) I stop seeing the above ICMP message.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.