3Com MSR 50 Series Configuration Manual page 637

When receiving a packet with the destination being local and transport layer
■
protocol being UDP, if the packet's port number does not match the running
process, the device will send the source a "port unreachable" ICMP error
packet.
If the source uses "strict source routing" to send packets, but the intermediate
■
device finds the next hop specified by the source is not directly connected, the
device will send the source a "source routing failure" ICMP error packet.
When forwarding a packet, if the MTU of the sending interface is smaller than
■
the packet but the packet has been set "Don't Fragment", the device will send
the source a "fragmentation needed and Don't Fragment (DF)-set" ICMP error
packet.
Disadvantage of sending ICMP error packets
Although sending ICMP error packets facilitates network control and
management, it still has the following disadvantages:
Sending a lot of ICMP packets will increase network traffic.
■
If receiving a lot of malicious packets that cause it to send ICMP error packets,
■
the device's performance will be reduced.
As the redirection function increases the routing table size of a host, the host's
■
performance will be reduced if its routing table becomes very large.
If a host sends malicious ICMP destination unreachable packets, end users may
■
be affected.
To prevent such problems, you can disable the device from sending ICMP error
packets.
Follow these steps to disable sending ICMP error packets:
To do...
Enter system view
Disable sending ICMP
redirection packets
Disable sending ICMP timeout
packets
Disable sending ICMP
destination unreachable
packets
n
The device stops sending "network unreachable" and "source route failure"
■
ICMP error packets after sending ICMP destination unreachable packets is
disabled. However, other destination unreachable packets can be sent
normally.
The device stops sending "TTL timeout" ICMP error packets after sending ICMP
■
timeout packets is disabled. However, "reassembly timeout" error packets will
be sent normally.
Configuring ICMP to Send Error Packets
Use the command...
system-view
undo ip redirects
undo ip ttl-expires
undo ip unreachables
637
Remarks
-
Required
Enabled by default.
Required
Enabled by default.
Required
Enabled by default.