13-6
3) ICMP destination unreachable packets
If the device receives an IP packet whose destination is unreachable, it drops the packet and sends an
ICMP destination unreachable error packet to the source.
Conditions for sending ICMP destination unreachable packets:
z
If a packet matches no route, the device sends a “network unreachable” ICMP error packet.
z
If the transport layer protocol of a packet destined to the receiving device is not supported by the
receiving device, the device sends a “protocol unreachable” ICMP error packet to the source.
z
If a packet destined to the receiving device has a UDP destination port number that does not
match the running process, the device sends the source a “port unreachable” ICMP error packet.
z
If the source uses “strict source routing" to send packets, but the intermediate device finds that
the next hop specified by the source is not directly connected, the device send the source a
“source routing failure” ICMP error packet.
z
If the MTU of the sending interface is smaller than the packet to be forwarded but the packet has
been set “Don’t Fragment”, the device sends the source a “fragmentation needed and Don’t
Fragment (DF)-set” ICMP error packet.
Disadvantages of sending ICMP error packets
Although sending ICMP error packets facilitates network control and management, it still has the
following disadvantages:
z
ICMP error packets increase network traffic.
z
A device’s performance degrades if it receives high numbers of malicious packets that cause it to
respond with ICMP error packets.
z
A host’s performance degrades if the redirection function significantly increases the size of its
routing table.
z
End users can be affected if a host sends malicious ICMP destination unreachable packets.
Therefore, the device is disabled from sending ICMP error packets by default.
Follow these steps to enable sending of ICMP error packets:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enable sending of ICMP redirect packets
ip redirects enable
Required
Disabled by default.
Enable sending of ICMP timeout packets
ip ttl-expires enable
Required
Disabled by default.
Enable sending of ICMP destination
unreachable packets
ip unreachables enable
Required
Disabled by default.
