ICMP L3retriever Pings from landlord's computer

Discussion in 'other firewalls' started by ZeroEffect, May 27, 2009.

Thread Status:
Not open for further replies.
  1. ZeroEffect

    ZeroEffect Registered Member

    Joined:
    May 27, 2009
    Posts:
    1
    I'm running Sunbelt firewall on my laptop. I just moved into a new place and I'm using my landlord's wireless router. He manages the router. Everything was fine for a couple weeks but recently my internet speed has slowed. A couple days ago the firewall started noting ICMP L3retriever pings coming from my landlord's computer. What's he doing that I'm suddenly getting these pings? Is it a form of attack? I've been on shared wireless networks before but have never encountered this.
     
  2. vijayind

    vijayind Registered Member

    Joined:
    Aug 9, 2008
    Posts:
    1,413
    ICMP L3retriever ping is used by hosts and routers to solve connectivity issues. Basically its used to issue an ICMP Echo reply and check if the host is connected.
    So if Host A wants to know if Host B is still connected or switched off after some period of inactivity, it will sent an ICMP L3retriever to check if the L3 session/host is still active. Ideally Host B will then send a Echo Reply to confirm.

    The problem is that these methods were developed in the early days of networking. So now technically, anyone can use/spoof to check if a L3 session/host is active. Hence modern firewalls/NDS/IDS block it and sound alert.

    If I remember correctly some old machines and products still employ ICMP L3retriever including some popular one like Linksys.
     
Loading...
Thread Status:
Not open for further replies.